01Governance & Leadership
Maps to: SOC 2 CC1, ISO 27001 Clause 5 Security is not solely an engineering problem; it is a business risk. This domain ensures that executive leadership takes formal, documented responsibility for the organisation’s security posture. It requires the establishment of a formal security programme, clear reporting lines, and regular management reviews of security metrics.
Key Controls
- Formal appointment of a Chief Information Security Officer (CISO) or equivalent security lead.
- Documented and executive-approved Information Security Policy.
- Annual management review of security posture and risk register.
02Identity & Access Management
Maps to: SOC 2 CC6, ISO 27001 Annex A.9 In a cloud-native world, identity is the new perimeter. This domain mandates strict controls over who can access systems, data, and infrastructure. It enforces the Principle of Least Privilege (PoLP) and requires modern authentication mechanisms across all environments.
Key Controls
- Mandatory Multi-Factor Authentication (MFA) for all systems.
- Role-Based Access Control (RBAC) with documented approval workflows.
- Automated access revocation within 24 hours of employee termination.
03Data Protection & Privacy
Maps to: SOC 2 Confidentiality, ISO 27001 Annex A.8 Protecting customer data from unauthorised access or disclosure is the core objective of any security standard. This domain covers the encryption, handling, and lifecycle management of sensitive information, ensuring compliance with global privacy regulations like GDPR and the Australian Privacy Act.
Key Controls
- AES-256 encryption for all data at rest.
- TLS 1.2 or higher for all data in transit.
- Formal data classification and retention policies.
04Infrastructure Security
Maps to: SOC 2 CC6, ISO 27001 Annex A.13 Securing the underlying networks and servers that host your application. This domain requires defence-in-depth strategies, including network segmentation, firewall configuration, and intrusion detection systems, tailored for modern cloud environments.
Key Controls
- Virtual Private Cloud (VPC) isolation for database and backend services.
- Web Application Firewall (WAF) deployment.
- DDoS mitigation and rate-limiting controls.
05Application Security
Maps to: SOC 2 CC8, ISO 27001 Annex A.14 Ensuring that the software you build is secure by design. This domain integrates security into the Software Development Life Cycle (SDLC), requiring automated testing, secure coding practices, and regular vulnerability assessments.
Key Controls
- Mandatory peer review for all code changes.
- Automated Static Application Security Testing (SAST) in the CI/CD pipeline.
- Annual independent penetration testing.
06Cloud & Container Security
DSS-1200 Exclusive (Partial overlap with SOC 2/ISO) Legacy frameworks struggle with ephemeral infrastructure. This domain introduces specific controls for containerised workloads (Docker, Kubernetes) and serverless architectures (AWS Lambda, Vercel), ensuring these modern environments are hardened against attack.
Key Controls
- Automated container image vulnerability scanning.
- Strict IAM role scoping for serverless functions.
- Immutable infrastructure deployment practices.
07AI & Emerging Technology Governance
DSS-1200 Exclusive The defining feature of the DSS-1200 framework. As software increasingly relies on Large Language Models (LLMs) and AI APIs, this domain mandates controls to prevent data leakage, prompt injection, and unauthorised model training on customer data.
Key Controls
- Contractual guarantees preventing third-party AI providers from training on customer data.
- Input sanitisation and prompt injection mitigation strategies.
- Formal AI acceptable use policy for employees.
08Supply Chain & Third-Party Risk
Maps to: SOC 2 CC3, ISO 27001 Annex A.15 You are only as secure as your weakest vendor. This domain requires rigorous assessment of all third-party sub-processors, open-source dependencies, and infrastructure providers to prevent supply chain attacks.
Key Controls
- Continuous Software Composition Analysis (SCA) for open-source dependencies.
- Mandatory security reviews (SOC 2/ISO 27001 verification) for all sub-processors.
- Public transparency of all sub-processors handling customer data.
09Incident Response & Logging
Maps to: SOC 2 CC7, ISO 27001 Annex A.16 When a breach occurs, speed and visibility are critical. This domain ensures you have the telemetry required to detect an attack and the formal procedures required to contain and eradicate it.
Key Controls
- Centralised, immutable audit logging for all critical systems.
- Documented and annually tested Incident Response Plan (IRP).
- Defined SLAs for customer notification in the event of a breach.
10Physical & Environmental Security
Maps to: SOC 2 CC6.4, ISO 27001 Annex A.11 While modern companies operate in the cloud, physical security still matters. This domain covers the physical security of corporate offices, employee devices, and the verification of data centre physical controls.
Key Controls
- Full-disk encryption and Mobile Device Management (MDM) for all employee laptops.
- Verification of SOC 2/ISO 27001 physical security compliance for all cloud data centres.
- Clean desk and screen locking policies.
11Legal & Regulatory Compliance
Maps to: ISO 27001 Annex A.18 Security must align with the law. This domain ensures the organisation identifies and complies with all relevant statutory, regulatory, and contractual security requirements in the jurisdictions where it operates.
Key Controls
- Formal tracking of relevant legislation (e.g., GDPR, Privacy Act, AUSTRAC).
- Documented data breach notification procedures aligned with legal requirements.
- Regular compliance audits against contractual commitments.
12Continuous Monitoring & Threat Detection
DSS-1200 Exclusive (Evolution of SOC 2 CC7) Moving away from point-in-time compliance. This domain requires the implementation of automated systems that continuously monitor the environment for configuration drift, vulnerabilities, and active threats.
Key Controls
- Automated Cloud Security Posture Management (CSPM).
- Real-time alerting for critical security events.
- Defined SLAs for vulnerability remediation based on severity.