| Access Control (AC) |
| AC.L2-3.1.3 |
Control CUI Flow |
Blocks or warns before CUI leaves via browser uploads |
|
| AC.L1-3.1.20 |
External Connections |
Restricts/monitors outbound uploads to external systems |
|
| AC.L2-3.1.21 |
Portable Storage Use |
Blocks uploads to cloud storage endpoints |
|
| Audit & Accountability (AU) |
| AU.L2-3.3.1 |
System Auditing |
All actions (allow/warn/block) logged in Supabase |
|
| AU.L2-3.3.2 |
User Accountability |
Logs tied to user email/client ID |
|
| AU.L2-3.3.5 |
Audit Correlation |
Centralized logs feed SIEM for incident correlation |
|
| AU.L2-3.3.8 |
Audit Protection |
Logs protected in backend DB with limited admin control |
|
| Configuration Management (CM) |
| CM.L2-3.4.6 |
Least Functionality |
Prevents risky uploads not essential for work |
|
| CM.L2-3.4.7 |
Nonessential Functionality |
Blocks unapproved services by upload policy |
|
| CM.L2-3.4.8 |
Application Execution Policy |
Enforces blacklist/whitelist on uploads |
|
| CM.L2-3.4.9 |
User-Installed Software |
Controls data exfiltration via shadow IT apps |
|
| System & Communications Protection (SC) |
| SC.L1-3.13.1 |
Boundary Protection |
Intercepts communications leaving browser endpoints |
|
| SC.L2-3.13.6 |
Network Communication by Exception |
Domain allow/block lists enforce deny-all approach |
|
| SC.L2-3.13.8 |
Data in Transit |
Ensures HTTPS uploads, blocks insecure transfers |
|
| SC.L2-3.13.16 |
Data at Rest |
Sensitive data blocked before external storage |
|
| System & Information Integrity (SI) |
| SI.L1-3.14.2 |
Malicious Code Protection |
Scans uploads for risky content before submission |
|
| SI.L1-3.14.5 |
System & File Scanning |
Real-time scanning of every upload |
|
| SI.L2-3.14.6 |
Monitor Communications for Attacks |
Detects exfiltration attempts via browser |
|
| SI.L2-3.14.7 |
Identify Unauthorized Use |
Policy violations expose system misuse |
|
| Partial Coverage - Supporting Controls |
| IR.L2-3.6.1 |
Incident Handling |
Provides logs/alerts for IR team |
|
| IR.L2-3.6.2 |
Incident Reporting |
Evidence collection for reporting |
|
| RA.L2-3.11.1 |
Risk Assessments |
Violation analytics provide risk data |
|
| RA.L2-3.11.2 |
Vulnerability Scan |
Identifies shadow IT risks |
|
| CA.L2-3.12.1 |
Security Control Assessment |
Reports feed into assessments |
|
| CA.L2-3.12.4 |
System Security Plan |
Evidence/logs for SSP documentation |
|
