{
	"schema_version": 1,
	"framework": "STRIDE",
	"url": "https://stride.asymmetric.re/framework",
	"pillars": [
		{
			"name": "Program Security",
			"description": "Covers code review, audits, vulnerability disclosure, on-chain safeguards, and automated tooling.",
			"controls": [
				{
					"id": "P1.1",
					"group": "Internal Review Process",
					"requirement": "All code changes undergo security-focused review with documented sign-off before deployment.",
					"critical": false
				},
				{
					"id": "P1.2",
					"group": "Internal Review Process",
					"requirement": "Review covers correctness.",
					"critical": false
				},
				{
					"id": "P1.3",
					"group": "Internal Review Process",
					"requirement": "Review covers security properties.",
					"critical": false
				},
				{
					"id": "P2.1",
					"group": "External Audit Coverage",
					"requirement": "Critical code paths and major changes are reviewed by independent security firms.",
					"critical": true
				},
				{
					"id": "P2.2",
					"group": "External Audit Coverage",
					"requirement": "Findings are tracked to resolution.",
					"critical": false
				},
				{
					"id": "P2.3",
					"group": "External Audit Coverage",
					"requirement": "The audit scope covers the currently deployed version.",
					"critical": true
				},
				{
					"id": "P3.1",
					"group": "Vulnerability Disclosure & Bug Bounty",
					"requirement": "An active, monitored bug bounty program with defined scope and clear severity tiers is active.",
					"critical": false
				},
				{
					"id": "P3.2",
					"group": "Vulnerability Disclosure & Bug Bounty",
					"requirement": "A published security contact with a committed triage timeline exists.",
					"critical": false
				},
				{
					"id": "P3.3",
					"group": "Vulnerability Disclosure & Bug Bounty",
					"requirement": "Program binary includes solana-security-txt metadata (contact, policy, source URL).",
					"critical": false
				},
				{
					"id": "P4.1",
					"group": "Defense-in-Depth Mechanisms",
					"requirement": "On-chain safeguards that limit the blast radius of a single vulnerability or compromise are deployed.",
					"critical": false
				},
				{
					"id": "P4.2",
					"group": "Defense-in-Depth Mechanisms",
					"requirement": "Rate limits on transfer volume deployed.",
					"critical": false
				},
				{
					"id": "P4.3",
					"group": "Defense-in-Depth Mechanisms",
					"requirement": "Per-epoch caps deployed.",
					"critical": false
				},
				{
					"id": "P4.4",
					"group": "Defense-in-Depth Mechanisms",
					"requirement": "Circuit breakers triggered by invariant violations deployed.",
					"critical": false
				},
				{
					"id": "P4.5",
					"group": "Defense-in-Depth Mechanisms",
					"requirement": "Reduce unnecessary composability (e.g., CPI disabled on admin instructions).",
					"critical": false
				},
				{
					"id": "P4.6",
					"group": "Defense-in-Depth Mechanisms",
					"requirement": "Graduated withdrawal limits deployed.",
					"critical": false
				},
				{
					"id": "P5.1",
					"group": "Automated Security Tooling",
					"requirement": "Continuous security tooling integrated into CI/CD to detect common Solana footguns.",
					"critical": false
				},
				{
					"id": "P5.2",
					"group": "Automated Security Tooling",
					"requirement": "Includes fuzz testing.",
					"critical": false
				},
				{
					"id": "P5.3",
					"group": "Automated Security Tooling",
					"requirement": "Includes static analysis.",
					"critical": false
				},
				{
					"id": "P5.4",
					"group": "Automated Security Tooling",
					"requirement": "Includes property-based testing.",
					"critical": false
				},
				{
					"id": "P5.5",
					"group": "Automated Security Tooling",
					"requirement": "Includes formal verification.",
					"critical": false
				},
				{
					"id": "P5.6",
					"group": "Automated Security Tooling",
					"requirement": "Includes AI-assisted review.",
					"critical": false
				}
			]
		},
		{
			"name": "Governance",
			"description": "Covers privileged roles, upgrade authority, timelocks, multisig configuration, and risk parameter controls.",
			"controls": [
				{
					"id": "G1.1",
					"group": "Privileged Roles & Separation of Duties",
					"requirement": "All privileged roles are documented with explicit enumeration of their capabilities.",
					"critical": false
				},
				{
					"id": "G1.2",
					"group": "Privileged Roles & Separation of Duties",
					"requirement": "Roles follow least-privilege principles; no single role can both modify parameters and move funds.",
					"critical": false
				},
				{
					"id": "G1.3",
					"group": "Privileged Roles & Separation of Duties",
					"requirement": "Role assignments are verifiable on-chain.",
					"critical": false
				},
				{
					"id": "G1.4",
					"group": "Privileged Roles & Separation of Duties",
					"requirement": "Individual actors should not have an overlap of duties that create perverse incentives.",
					"critical": false
				},
				{
					"id": "G1.5",
					"group": "Privileged Roles & Separation of Duties",
					"requirement": "Individual actors should not have an overlap of duties that create an attack vector.",
					"critical": false
				},
				{
					"id": "G2.1",
					"group": "Upgrade Authority",
					"requirement": "Program upgrade authority is clearly defined.",
					"critical": false
				},
				{
					"id": "G2.2",
					"group": "Upgrade Authority",
					"requirement": "Program upgrade authority is multisig-controlled.",
					"critical": true
				},
				{
					"id": "G2.3",
					"group": "Upgrade Authority",
					"requirement": "Program upgrade authority is governance-gated.",
					"critical": false
				},
				{
					"id": "G2.4",
					"group": "Upgrade Authority",
					"requirement": "If upgradeable, users can verify the currently deployed version against source via the verified builds API.",
					"critical": false
				},
				{
					"id": "G2.5",
					"group": "Upgrade Authority",
					"requirement": "Authority transfer and revocation procedures exist.",
					"critical": false
				},
				{
					"id": "G2.6",
					"group": "Upgrade Authority",
					"requirement": "If upgradeable, the upgrade path is documented.",
					"critical": false
				},
				{
					"id": "G3.1",
					"group": "Timelock & Delay Mechanisms",
					"requirement": "Privileged actions are subject to enforced on-chain timelocks with duration proportional to impact.",
					"critical": false
				},
				{
					"id": "G3.2",
					"group": "Timelock & Delay Mechanisms",
					"requirement": "Emergency bypass conditions are explicitly defined, documented, and scoped.",
					"critical": false
				},
				{
					"id": "G3.3",
					"group": "Timelock & Delay Mechanisms",
					"requirement": "Timelock duration is publicly auditable.",
					"critical": false
				},
				{
					"id": "G3.4",
					"group": "Timelock & Delay Mechanisms",
					"requirement": "Bypass history is publicly auditable.",
					"critical": false
				},
				{
					"id": "G4.1",
					"group": "Multisig Configuration",
					"requirement": "Multisig threshold is documented.",
					"critical": false
				},
				{
					"id": "G4.2",
					"group": "Multisig Configuration",
					"requirement": "Multisig total signer count is documented.",
					"critical": false
				},
				{
					"id": "G4.3",
					"group": "Multisig Configuration",
					"requirement": "Multisig signer identity is documented.",
					"critical": false
				},
				{
					"id": "G4.4",
					"group": "Multisig Configuration",
					"requirement": "Threshold is at least half the signer count and never 1-of-n (e.g., 3-of-5 or higher).",
					"critical": true
				},
				{
					"id": "G4.5",
					"group": "Multisig Configuration",
					"requirement": "Key rotation procedures are in place.",
					"critical": false
				},
				{
					"id": "G4.6",
					"group": "Multisig Configuration",
					"requirement": "Signer removal procedures are in place.",
					"critical": false
				},
				{
					"id": "G4.7",
					"group": "Multisig Configuration",
					"requirement": "No single entity controls a number of keys equal to or greater than the threshold.",
					"critical": true
				},
				{
					"id": "G4.8",
					"group": "Multisig Configuration",
					"requirement": "Signer hardware wallets have vendor diversity.",
					"critical": false
				},
				{
					"id": "G5.1",
					"group": "Risk Parameter Controls",
					"requirement": "Economic parameters (collateral factors) are governed by a named, access-controlled role (not an arbitrary EOA) with documented change procedures.",
					"critical": false
				},
				{
					"id": "G5.2",
					"group": "Risk Parameter Controls",
					"requirement": "Economic parameters (liquidation thresholds) are governed by a named, access-controlled role (not an arbitrary EOA) with documented change procedures.",
					"critical": false
				},
				{
					"id": "G5.3",
					"group": "Risk Parameter Controls",
					"requirement": "Economic parameters (fee structures) are governed by a named, access-controlled role (not an arbitrary EOA) with documented change procedures.",
					"critical": false
				},
				{
					"id": "G5.4",
					"group": "Risk Parameter Controls",
					"requirement": "Economic parameters (rate models) are governed by a named, access-controlled role (not an arbitrary EOA) with documented change procedures.",
					"critical": false
				},
				{
					"id": "G5.5",
					"group": "Risk Parameter Controls",
					"requirement": "Parameter bounds and their downstream impact on users are specified.",
					"critical": false
				},
				{
					"id": "G5.6",
					"group": "Risk Parameter Controls",
					"requirement": "Historical parameter changes are logged and publicly accessible.",
					"critical": false
				}
			]
		},
		{
			"name": "Oracle & External Dependencies",
			"description": "Covers dependency mapping, oracle architecture, staleness handling, and blast radius containment.",
			"controls": [
				{
					"id": "E1.1",
					"group": "Dependency Mapping & Trust Documentation",
					"requirement": "All external dependencies, oracles, bridges, keeper networks, programs invoked via CPI, and off-chain data sources are enumerated with explicit trust assumptions documented for each.",
					"critical": false
				},
				{
					"id": "E1.2",
					"group": "Dependency Mapping & Trust Documentation",
					"requirement": "For every dependency, the failure mode is specified: what happens if it lies, goes stale, or disappears.",
					"critical": false
				},
				{
					"id": "E1.3",
					"group": "Dependency Mapping & Trust Documentation",
					"requirement": "Trust boundaries are clearly drawn, distinguishing what the protocol verifies from what it assumes correct.",
					"critical": false
				},
				{
					"id": "E2.1",
					"group": "Oracle Architecture & Manipulation Resistance",
					"requirement": "Price feeds use multiple independent sources; where a single source is used, the reason no second source is available is documented.",
					"critical": false
				},
				{
					"id": "E2.2",
					"group": "Oracle Architecture & Manipulation Resistance",
					"requirement": "Aggregation method is documented (median, TWAP, weighted).",
					"critical": false
				},
				{
					"id": "E2.3",
					"group": "Oracle Architecture & Manipulation Resistance",
					"requirement": "Confidence intervals or deviation thresholds are enforced on-chain.",
					"critical": true
				},
				{
					"id": "E2.4",
					"group": "Oracle Architecture & Manipulation Resistance",
					"requirement": "Known threat vectors for the specific oracle setup are identified and mitigated.",
					"critical": false
				},
				{
					"id": "E2.5",
					"group": "Oracle Architecture & Manipulation Resistance",
					"requirement": "Oracle selection rationale is documented: why this provider, for this asset, at this update frequency.",
					"critical": false
				},
				{
					"id": "E3.1",
					"group": "Staleness & Liveness Handling",
					"requirement": "Maximum acceptable age for every external input is defined and enforced on-chain.",
					"critical": true
				},
				{
					"id": "E3.2",
					"group": "Staleness & Liveness Handling",
					"requirement": "Fallback behavior when inputs are stale or unavailable is specified.",
					"critical": false
				},
				{
					"id": "E3.3",
					"group": "Staleness & Liveness Handling",
					"requirement": "Liveness monitoring is in place for every external input.",
					"critical": false
				},
				{
					"id": "E4.1",
					"group": "Blast Radius Containment",
					"requirement": "No single dependency failure can drain the protocol.",
					"critical": true
				},
				{
					"id": "E4.2",
					"group": "Blast Radius Containment",
					"requirement": "Exposure per external dependency is capped or isolated (e.g., per-market oracle assignment, bridge deposit limits, maximum exposure per collateral type).",
					"critical": false
				}
			]
		},
		{
			"name": "Infrastructure",
			"description": "Covers DNS and domain security, web application security, key management, off-chain services, RPC dependencies, and independent security testing.",
			"controls": [
				{
					"id": "I1.1",
					"group": "DNS & Domain Security",
					"requirement": "Domain registrar accounts are hardened (hardware 2FA, restricted account recovery).",
					"critical": false
				},
				{
					"id": "I1.2",
					"group": "DNS & Domain Security",
					"requirement": "Domain lock is enabled to prevent unauthorized transfers.",
					"critical": false
				},
				{
					"id": "I1.3",
					"group": "DNS & Domain Security",
					"requirement": "Registrar access is limited to the minimum necessary personnel, with access logged.",
					"critical": false
				},
				{
					"id": "I1.4",
					"group": "DNS & Domain Security",
					"requirement": "Expiration monitoring is in place.",
					"critical": false
				},
				{
					"id": "I2.1",
					"group": "Web Application Security",
					"requirement": "Frontend and API surfaces undergo regular penetration testing.",
					"critical": false
				},
				{
					"id": "I2.2",
					"group": "Web Application Security",
					"requirement": "Web infrastructure uses CSP headers.",
					"critical": false
				},
				{
					"id": "I2.3",
					"group": "Web Application Security",
					"requirement": "Web infrastructure uses subresource integrity (SRI).",
					"critical": false
				},
				{
					"id": "I2.4",
					"group": "Web Application Security",
					"requirement": "Web infrastructure uses input validation.",
					"critical": false
				},
				{
					"id": "I3.1",
					"group": "Key Management",
					"requirement": "Cryptographic keys for privileged operations are stored in HSMs or cloud KMS.",
					"critical": false
				},
				{
					"id": "I3.2",
					"group": "Key Management",
					"requirement": "Cryptographic keys for privileged operations are not stored in plaintext.",
					"critical": true
				},
				{
					"id": "I3.3",
					"group": "Key Management",
					"requirement": "Cryptographic keys for privileged operations are not stored in environment variables.",
					"critical": true
				},
				{
					"id": "I3.4",
					"group": "Key Management",
					"requirement": "Cryptographic keys for privileged operations are not stored in source control.",
					"critical": true
				},
				{
					"id": "I3.5",
					"group": "Key Management",
					"requirement": "Key generation follows a documented ceremony.",
					"critical": false
				},
				{
					"id": "I3.6",
					"group": "Key Management",
					"requirement": "Rotation schedule exists and is enforced.",
					"critical": false
				},
				{
					"id": "I3.7",
					"group": "Key Management",
					"requirement": "Access to signing infrastructure requires multi-party authorization.",
					"critical": false
				},
				{
					"id": "I3.8",
					"group": "Key Management",
					"requirement": "Backup and recovery procedures are tested on a recurring basis.",
					"critical": false
				},
				{
					"id": "I4.1",
					"group": "Off-Chain Services & Backend Infrastructure",
					"requirement": "All off-chain components, cranks, keepers, liquidation bots, relayers, indexers, APIs, are enumerated with their availability requirements and failure impact documented.",
					"critical": false
				},
				{
					"id": "I4.2",
					"group": "Off-Chain Services & Backend Infrastructure",
					"requirement": "Services run with redundancy and failover.",
					"critical": false
				},
				{
					"id": "I4.3",
					"group": "Off-Chain Services & Backend Infrastructure",
					"requirement": "Secrets management uses dedicated tooling; not shared credentials.",
					"critical": false
				},
				{
					"id": "I4.4",
					"group": "Off-Chain Services & Backend Infrastructure",
					"requirement": "Server and container access follows the principle of least privilege with audit logging.",
					"critical": false
				},
				{
					"id": "I4.5",
					"group": "Off-Chain Services & Backend Infrastructure",
					"requirement": "Cloud infrastructure configuration is reviewed for misconfigurations (public buckets, overly permissive IAM).",
					"critical": false
				},
				{
					"id": "I5.1",
					"group": "RPC & Network Dependencies",
					"requirement": "RPC provider strategy is documented (self-hosted, third-party, or hybrid).",
					"critical": false
				},
				{
					"id": "I5.2",
					"group": "RPC & Network Dependencies",
					"requirement": "Critical paths reach the chain through at least two independent RPC providers.",
					"critical": false
				},
				{
					"id": "I5.3",
					"group": "RPC & Network Dependencies",
					"requirement": "Fallback RPC endpoints are configured and tested.",
					"critical": false
				},
				{
					"id": "I5.4",
					"group": "RPC & Network Dependencies",
					"requirement": "Rate limits and provider SLAs are documented alongside the protocol's peak throughput requirements.",
					"critical": false
				},
				{
					"id": "I5.5",
					"group": "RPC & Network Dependencies",
					"requirement": "Where the protocol runs or depends on validators, its client diversity choices are documented.",
					"critical": false
				},
				{
					"id": "I6.1",
					"group": "Independent Security Testing",
					"requirement": "An independent third party conducts a red team or penetration test engagement against off-chain and corporate infrastructure at least annually, with the scope stated in writing and covering identity and SSO, cloud accounts, CI/CD, internal networks, and employee endpoints. Scope includes social engineering against personnel, or its exclusion is a deliberate documented decision.",
					"critical": false
				},
				{
					"id": "I6.2",
					"group": "Independent Security Testing",
					"requirement": "Red team and penetration test findings are tracked to resolution with owners and target dates, and high-severity findings are retested to confirm closure.",
					"critical": false
				}
			]
		},
		{
			"name": "Supply Chain & Release Process",
			"description": "Covers dependency management, branch protection, code review, signed releases, and CI/CD pipeline security.",
			"controls": [
				{
					"id": "S1.1",
					"group": "Dependency Management & Pinning",
					"requirement": "Dependency updates are deliberate and reviewed.",
					"critical": false
				},
				{
					"id": "S1.2",
					"group": "Dependency Management & Pinning",
					"requirement": "Crate and package provenance is verified.",
					"critical": false
				},
				{
					"id": "S1.3",
					"group": "Dependency Management & Pinning",
					"requirement": "Transitive dependencies are enumerated (e.g., via a full dependency tree or SBOM) and tracked for updates.",
					"critical": false
				},
				{
					"id": "S1.4",
					"group": "Dependency Management & Pinning",
					"requirement": "Developer's registry publish access (crates.io, npm, etc) is protected with hardware keys.",
					"critical": false
				},
				{
					"id": "S1.5",
					"group": "Dependency Management & Pinning",
					"requirement": "Developer's registry publish access is restricted to minimum maintainers.",
					"critical": false
				},
				{
					"id": "S2.1",
					"group": "Branch Protection & Access Controls",
					"requirement": "Main and release branches enforce no direct pushes.",
					"critical": false
				},
				{
					"id": "S2.2",
					"group": "Branch Protection & Access Controls",
					"requirement": "Main and release branches enforce required status checks.",
					"critical": false
				},
				{
					"id": "S2.3",
					"group": "Branch Protection & Access Controls",
					"requirement": "No single-administrator override is possible.",
					"critical": true
				},
				{
					"id": "S2.4",
					"group": "Branch Protection & Access Controls",
					"requirement": "Org-level settings (SSO, 2FA, outside collaborator policy) are hardened.",
					"critical": false
				},
				{
					"id": "S3.1",
					"group": "Code Review Process",
					"requirement": "All production code changes require review from at least one independent reviewer.",
					"critical": false
				},
				{
					"id": "S3.2",
					"group": "Code Review Process",
					"requirement": "Review cannot be bypassed for any path that leads to deployment.",
					"critical": true
				},
				{
					"id": "S3.3",
					"group": "Code Review Process",
					"requirement": "Review cannot be self-approved for any path that leads to deployment.",
					"critical": true
				},
				{
					"id": "S4.1",
					"group": "Signed & Reproducible Releases",
					"requirement": "Release artifacts are cryptographically signed.",
					"critical": false
				},
				{
					"id": "S4.2",
					"group": "Signed & Reproducible Releases",
					"requirement": "Builds are reproducible and verifiable against on-chain program hashes (solana-verify or equivalent).",
					"critical": false
				},
				{
					"id": "S4.3",
					"group": "Signed & Reproducible Releases",
					"requirement": "Verification status is monitored and re-verified after every upgrade.",
					"critical": false
				},
				{
					"id": "S4.4",
					"group": "Signed & Reproducible Releases",
					"requirement": "The release process is documented end-to-end: who triggers.",
					"critical": false
				},
				{
					"id": "S4.5",
					"group": "Signed & Reproducible Releases",
					"requirement": "The release process is documented end-to-end: what signs.",
					"critical": false
				},
				{
					"id": "S4.6",
					"group": "Signed & Reproducible Releases",
					"requirement": "The release process is documented end-to-end: where artifacts are published.",
					"critical": false
				},
				{
					"id": "S5.1",
					"group": "CI/CD Pipeline Security",
					"requirement": "Pipeline configuration is version-controlled.",
					"critical": false
				},
				{
					"id": "S5.2",
					"group": "CI/CD Pipeline Security",
					"requirement": "Pipeline configuration is review-gated.",
					"critical": false
				},
				{
					"id": "S5.3",
					"group": "CI/CD Pipeline Security",
					"requirement": "Secrets are scoped to specific pipelines.",
					"critical": false
				},
				{
					"id": "S5.4",
					"group": "CI/CD Pipeline Security",
					"requirement": "Builds run on hardened infrastructure.",
					"critical": false
				},
				{
					"id": "S5.5",
					"group": "CI/CD Pipeline Security",
					"requirement": "Builds run on ephemeral infrastructure.",
					"critical": false
				},
				{
					"id": "S5.6",
					"group": "CI/CD Pipeline Security",
					"requirement": "Third-party actions are pinned to specific versions.",
					"critical": false
				},
				{
					"id": "S5.7",
					"group": "CI/CD Pipeline Security",
					"requirement": "Third-party plugins are pinned to specific versions.",
					"critical": false
				},
				{
					"id": "S5.8",
					"group": "CI/CD Pipeline Security",
					"requirement": "Pipeline logs are retained for audit.",
					"critical": false
				}
			]
		},
		{
			"name": "Operational Security",
			"description": "Covers endpoint security, multisig operations, access management, communications channel security, treasury management, and sweeping of rewards from hot wallets.",
			"controls": [
				{
					"id": "O1.1",
					"group": "Endpoint Security",
					"requirement": "Endpoint detection & response (EDR) deployed across all team devices.",
					"critical": false
				},
				{
					"id": "O1.2",
					"group": "Endpoint Security",
					"requirement": "Mobile device management (MDM) is deployed across all team devices.",
					"critical": false
				},
				{
					"id": "O1.3",
					"group": "Endpoint Security",
					"requirement": "Timely OS patching and full-disk encryption are enforced across all team devices.",
					"critical": false
				},
				{
					"id": "O1.4",
					"group": "Endpoint Security",
					"requirement": "Offboarding procedures include device audit and remote wipe capability.",
					"critical": false
				},
				{
					"id": "O1.5",
					"group": "Endpoint Security",
					"requirement": "Endpoint compliance is enforced technically (e.g., non-compliant devices are automatically blocked from company systems), not merely a written policy.",
					"critical": false
				},
				{
					"id": "O2.1",
					"group": "Multisig Operations",
					"requirement": "Signers use hardware wallets on dedicated devices.",
					"critical": true
				},
				{
					"id": "O2.2",
					"group": "Multisig Operations",
					"requirement": "Transactions are verified out-of-band before signing (e.g., via a separate channel confirming transaction details, alternative Squads UI).",
					"critical": true
				},
				{
					"id": "O2.3",
					"group": "Multisig Operations",
					"requirement": "Signing procedures are documented with clear expectations for what signers must verify.",
					"critical": false
				},
				{
					"id": "O2.4",
					"group": "Multisig Operations",
					"requirement": "Both a signer availability procedure and a signer backup procedure exist and are documented.",
					"critical": false
				},
				{
					"id": "O3.1",
					"group": "Access Management",
					"requirement": "All internal systems behind SSO with hardware-backed 2FA.",
					"critical": false
				},
				{
					"id": "O3.2",
					"group": "Access Management",
					"requirement": "Access provisioned on a least-privilege basis.",
					"critical": false
				},
				{
					"id": "O3.3",
					"group": "Access Management",
					"requirement": "Onboarding, offboarding, and eviction checklists and procedures exist and are enforced.",
					"critical": false
				},
				{
					"id": "O3.4",
					"group": "Access Management",
					"requirement": "Access reviews are conducted periodically to catch stale permissions.",
					"critical": false
				},
				{
					"id": "O4.1",
					"group": "Communications Channel Security",
					"requirement": "All protocol-controlled channels secured with hardware 2FA where possible.",
					"critical": false
				},
				{
					"id": "O4.2",
					"group": "Communications Channel Security",
					"requirement": "Discord/Telegram/Other bot permissions and webhook access are audited and restricted.",
					"critical": false
				},
				{
					"id": "O4.3",
					"group": "Communications Channel Security",
					"requirement": "Admin access is restricted.",
					"critical": false
				},
				{
					"id": "O4.4",
					"group": "Communications Channel Security",
					"requirement": "Admin access is logged.",
					"critical": false
				},
				{
					"id": "O4.5",
					"group": "Communications Channel Security",
					"requirement": "Every team member has a separate, individually attributable account; no shared logins are used for protocol-controlled channels.",
					"critical": false
				},
				{
					"id": "O4.6",
					"group": "Communications Channel Security",
					"requirement": "Channel recovery procedures are documented in the event of a compromise.",
					"critical": false
				},
				{
					"id": "O5.1",
					"group": "Treasury & Fund Management",
					"requirement": "Operational and reserve funds are held in multisig wallets whose threshold cannot be met by a single entity's keys.",
					"critical": true
				},
				{
					"id": "O5.2",
					"group": "Treasury & Fund Management",
					"requirement": "Spending limits workflows are defined.",
					"critical": false
				},
				{
					"id": "O5.3",
					"group": "Treasury & Fund Management",
					"requirement": "Spending limits approval workflows are defined.",
					"critical": false
				},
				{
					"id": "O5.4",
					"group": "Treasury & Fund Management",
					"requirement": "Funds movements are logged.",
					"critical": false
				},
				{
					"id": "O5.5",
					"group": "Treasury & Fund Management",
					"requirement": "Funds movements are reconciled.",
					"critical": false
				},
				{
					"id": "O5.6",
					"group": "Treasury & Fund Management",
					"requirement": "No single individual can unilaterally move protocol funds.",
					"critical": true
				},
				{
					"id": "O6.1",
					"group": "Systems Inventory",
					"requirement": "All systems are inventoried and known, with clear system owners assigned.",
					"critical": false
				},
				{
					"id": "O6.2",
					"group": "Systems Inventory",
					"requirement": "Sensitive data in each system is cataloged in a documented inventory.",
					"critical": false
				},
				{
					"id": "O6.3",
					"group": "Systems Inventory",
					"requirement": "Inventory is kept up-to-date through onboarding & offboarding processes.",
					"critical": false
				},
				{
					"id": "O6.4",
					"group": "Systems Inventory",
					"requirement": "Inventory is kept up-to-date through periodic review.",
					"critical": false
				},
				{
					"id": "O7.1",
					"group": "Hot Wallet & Reward Sweeping",
					"requirement": "Accounts controlled by operationally hot keys (validator identity accounts, vote accounts, relayers, keepers, fee payers) are inventoried with a defined maximum balance each may hold.",
					"critical": false
				},
				{
					"id": "O7.2",
					"group": "Hot Wallet & Reward Sweeping",
					"requirement": "Rewards and accrued balances are swept on an enforced schedule with a defined maximum interval, to a destination that no operational host key controls and from which onward movement requires multi-party authorization (a multisig, an HSM with policy enforcement, or a custodial/exchange account with an enforced withdrawal-approval policy and address allowlist).",
					"critical": false
				},
				{
					"id": "O7.3",
					"group": "Hot Wallet & Reward Sweeping",
					"requirement": "Hot account balances and sweep completion are monitored, alerting when a defined maximum is exceeded or a scheduled sweep does not land.",
					"critical": false
				},
				{
					"id": "O7.4",
					"group": "Hot Wallet & Reward Sweeping",
					"requirement": "Where an account's withdraw authority is separate from its operating key (for example vote accounts, stake accounts, and program-owned accounts that designate a withdraw authority), that authority is not present on any operational host, including sweep automation, and is held in multisig, HSM, or hardware-wallet custody.",
					"critical": true
				}
			]
		},
		{
			"name": "Monitoring & Incident Response",
			"description": "Covers real-time monitoring, circuit breakers, incident response plans, on-call, and security partnerships.",
			"controls": [
				{
					"id": "M1.1",
					"group": "On-chain & Application Monitoring",
					"requirement": "Critical program state changes, irregular multisig proposals (including durable nonce creation), large value transfers, upgrade authority changes on dependency programs, transfer hook program upgrades on held tokens, and anomalous transaction patterns are tracked in real time.",
					"critical": false
				},
				{
					"id": "M1.2",
					"group": "On-chain & Application Monitoring",
					"requirement": "Frontend and API availability are monitored.",
					"critical": false
				},
				{
					"id": "M1.3",
					"group": "On-chain & Application Monitoring",
					"requirement": "TVL deviations, liquidity shifts, and governance actions trigger alerts.",
					"critical": false
				},
				{
					"id": "M1.4",
					"group": "On-chain & Application Monitoring",
					"requirement": "Monitoring covers all deployed environments not just mainnet.",
					"critical": false
				},
				{
					"id": "M2.1",
					"group": "Automated Circuit Breakers",
					"requirement": "On-chain safeguards trigger automatically when invariants are violated, or thresholds are breached.",
					"critical": false
				},
				{
					"id": "M2.2",
					"group": "Automated Circuit Breakers",
					"requirement": "Circuit breakers are granular where possible (pause affected markets, not the entire protocol).",
					"critical": false
				},
				{
					"id": "M2.3",
					"group": "Automated Circuit Breakers",
					"requirement": "Trigger conditions and reset procedures are documented.",
					"critical": false
				},
				{
					"id": "M3.1",
					"group": "Incident Response Playbook",
					"requirement": "Documented IR plan with assigned roles, escalation paths, and communication templates.",
					"critical": false
				},
				{
					"id": "M3.2",
					"group": "Incident Response Playbook",
					"requirement": "The playbook covers common scenarios: compromised upgrade authority, exploit in progress, oracle failure, frontend compromise, key compromise.",
					"critical": false
				},
				{
					"id": "M3.3",
					"group": "Incident Response Playbook",
					"requirement": "Post-mortem process with root cause analysis and public disclosure timeline is defined.",
					"critical": false
				},
				{
					"id": "M3.4",
					"group": "Incident Response Playbook",
					"requirement": "A pause authority with documented activation procedures exists for emergency use.",
					"critical": false
				},
				{
					"id": "M4.1",
					"group": "On-call & Alerting Infrastructure",
					"requirement": "24/7 on-call rotation with defined response time SLAs.",
					"critical": false
				},
				{
					"id": "M4.2",
					"group": "On-call & Alerting Infrastructure",
					"requirement": "Alerting routes to PagerDuty or equivalent with escalation if unacknowledged.",
					"critical": false
				},
				{
					"id": "M4.3",
					"group": "On-call & Alerting Infrastructure",
					"requirement": "Alert fatigue is managed through tuning and severity tiering.",
					"critical": false
				},
				{
					"id": "M4.4",
					"group": "On-call & Alerting Infrastructure",
					"requirement": "Contact information is current and tested.",
					"critical": false
				},
				{
					"id": "M5.1",
					"group": "Security Partners & Ecosystem Coordination",
					"requirement": "Named points of contact at security firms and ecosystem security teams are established before an incident occurs.",
					"critical": false
				},
				{
					"id": "M5.2",
					"group": "Security Partners & Ecosystem Coordination",
					"requirement": "The responsible disclosure process is published.",
					"critical": false
				},
				{
					"id": "M5.3",
					"group": "Security Partners & Ecosystem Coordination",
					"requirement": "Protocol has a known point of contact for external security researchers.",
					"critical": false
				},
				{
					"id": "M5.4",
					"group": "Security Partners & Ecosystem Coordination",
					"requirement": "Cross-protocol communication channels exist for coordinated response to systemic events.",
					"critical": false
				},
				{
					"id": "M5.5",
					"group": "Security Partners & Ecosystem Coordination",
					"requirement": "Building on M5.1, the contact list, escalation procedures, and engagement protocols for those partners are documented, tested, and immediately accessible to on-call personnel.",
					"critical": false
				}
			]
		},
		{
			"name": "Logging & Alerting",
			"description": "Covers log coverage, collection and retention, normalization, detection rules, and alerting pipelines.",
			"controls": [
				{
					"id": "L1.1",
					"group": "Log Coverage",
					"requirement": "Critical systems are identified and onboarded to centralized logging (endpoints, network devices, identity systems, cloud platforms, applications, and security tooling).",
					"critical": false
				},
				{
					"id": "L1.2",
					"group": "Log Coverage",
					"requirement": "New systems are evaluated for logging requirements before production.",
					"critical": false
				},
				{
					"id": "L1.3",
					"group": "Log Coverage",
					"requirement": "Log sources are prioritized by risk and criticality.",
					"critical": false
				},
				{
					"id": "L2.1",
					"group": "Collection & Retention",
					"requirement": "Logs are centrally collected in near real-time.",
					"critical": false
				},
				{
					"id": "L2.2",
					"group": "Collection & Retention",
					"requirement": "Log integrity is protected through encryption in transit.",
					"critical": false
				},
				{
					"id": "L2.3",
					"group": "Collection & Retention",
					"requirement": "Log integrity is protected through access controls.",
					"critical": false
				},
				{
					"id": "L2.4",
					"group": "Collection & Retention",
					"requirement": "Retention periods meet regulatory requirements.",
					"critical": false
				},
				{
					"id": "L2.5",
					"group": "Collection & Retention",
					"requirement": "Retention periods meet business requirements.",
					"critical": false
				},
				{
					"id": "L3.1",
					"group": "Normalization & Enrichment",
					"requirement": "Ingested logs are normalized to a standard schema for consistent analysis.",
					"critical": false
				},
				{
					"id": "L3.2",
					"group": "Normalization & Enrichment",
					"requirement": "Logs are enriched with contextual metadata (asset criticality, user identity, threat intelligence indicators).",
					"critical": false
				},
				{
					"id": "L3.3",
					"group": "Normalization & Enrichment",
					"requirement": "Parsing rules are reviewed periodically.",
					"critical": false
				},
				{
					"id": "L4.1",
					"group": "Detection Rules & Tuning",
					"requirement": "Detection rules are implemented for defined use cases with severity classification.",
					"critical": false
				},
				{
					"id": "L4.2",
					"group": "Detection Rules & Tuning",
					"requirement": "Rules are tuned regularly to manage false positive and false negative rates.",
					"critical": false
				},
				{
					"id": "L4.3",
					"group": "Detection Rules & Tuning",
					"requirement": "Changes to detection logic follow change management procedures.",
					"critical": false
				},
				{
					"id": "L5.1",
					"group": "Alerting & Escalation",
					"requirement": "Alerts route through a defined pipeline: automated triage.",
					"critical": false
				},
				{
					"id": "L5.2",
					"group": "Alerting & Escalation",
					"requirement": "Alerts route through a defined pipeline: ticket creation.",
					"critical": false
				},
				{
					"id": "L5.3",
					"group": "Alerting & Escalation",
					"requirement": "Alerts route through a defined pipeline: notification to response teams.",
					"critical": false
				},
				{
					"id": "L5.4",
					"group": "Alerting & Escalation",
					"requirement": "High and critical severity alerts trigger immediate paging.",
					"critical": false
				},
				{
					"id": "L5.5",
					"group": "Alerting & Escalation",
					"requirement": "Escalation procedures and response SLAs are documented.",
					"critical": false
				}
			]
		}
	]
}