Platform Responsibilities
The contract states which application, infrastructure, monitoring, vulnerability, recovery and incident duties OreLynx accepts for the implementation.
Security evaluation
See How Access, Data and Activity Are Controlled
Evaluate each security objective against the deployed mechanism, test evidence, accountable owner, known limitations and your organisation’s responsibilities.
Share security requirementsSecurity Review Matrix
Use these questions to align the operating controls and evidence with the organisation, deployment and data classification.
| Control area | Decision question | Required evidence |
|---|---|---|
| Identity and access | How are authentication, role changes, privileged access, session handling and access reviews governed? | Approved policy, configuration evidence, authorisation tests and review records |
| Tenant boundaries | Where is tenant scope enforced for records, files, queues, exports, search, support and background work? | Architecture trace, negative isolation tests and exception handling evidence |
| Data protection | How are data, credentials, keys, backups, exports and endpoints protected for the selected deployment? | Current cryptographic configuration, key ownership, rotation and verification results |
| Security events | Which actions are recorded, protected, reviewed, retained and connected to an incident process? | Event catalogue, sample redacted records, access controls, alert tests and retention approval |
| Vulnerability and incident handling | How are findings accepted, prioritised, remediated, disclosed and learned from? | Ownership, response process, exercise results and open-risk register |
| Recovery and continuity | Can authorised teams restore the agreed service and prove the restored data is correct? | Backup scope, restoration test, dependency inventory and approved recovery objectives |
Customer Responsibilities
The assessment should cover authorised users, identity policy, endpoint safety, source-data classification, exported copies, integrations, lawful use and escalation contacts. Exact duties belong in the final agreement.