13.20 Security

User stories

• As an InfoSec officer, I want SIEM to surface anomalies.
• As an engineer, I want secrets vaulted and rotated.
• As a borrower, I want my PII encrypted and access-controlled.

API requirements

• POST /pii/tokenize, POST /pii/detokenize (audited).
• GET /security/incidents.

Data model

• pii_token, incident, vuln, pen_test.

UI screens

• InfoSec console: incidents, vulns, pen test findings.

Backend services

• PII vault.
• SIEM integration.
• IR orchestration.

External integrations

• KMS / Vault.
• SIEM vendor.
• Pen test partner.

Test cases

• PII tokenised at write.
• Detokenize logged per call.
• Vulnerability ticket auto-created.
• Pen test finding tracked.

Edge cases

• PII leak in log → DLP catches.
• Cred rotation cascading.
• Insider threat.

Acceptance criteria

• PII tokenisation 100% on inbound.
• Pen test annual.
• Material cyber incident reportable in < 6h.
• Quarterly access review.