Security & Certifications
A focused assurance programme for information security, AI governance and cryptographic modules
HEOSSI (PTE.) LTD. owns and administers the company compliance programme and is the prospective certificate holder. BEE, QNSI, and other HEOSSI solutions may be included within the documented organisational or technical scope; they are not separate certificate holders. Tentative target: Q4 2026 or Q1 2027, subject to funding. Internal framework posture; accredited certification and independent conformity assessment are not currently claimed. ISO/IEC 19790 applies only to specifically identified cryptographic modules or components.
Our Compliance Frameworks
A focused programme covering information security, AI governance and safety, and the security of applicable cryptographic modules. Tentative timing is Q4 2026 or Q1 2027, subject to funding.
HEOSSI (PTE.) LTD. owns and administers the company compliance programme and is the prospective certificate holder. BEE, QNSI, and other HEOSSI solutions may be included within the documented organisational or technical scope; they are not separate certificate holders.
Scope and gap assessment
Define the HEOSSI management-system boundaries and identify gaps against ISO/IEC 27001:2022 and ISO/IEC 42001:2023
Implementation and readiness
Implement prioritized controls, governance processes, evidence registers, internal reviews and corrective actions
Independent management-system assessment
Engage an accredited certification body for ISO/IEC 27001 and ISO/IEC 42001 when scope and evidence are ready
Cryptographic-module evaluation pathway
Assess applicable core cryptographic modules against ISO/IEC 19790:2025 and pursue validation or conformity assessment where an appropriate pathway is available
Standards in scope
ISO/IEC 27001:2022
Information Security
Planned alignment and certification-readiness programme for HEOSSI's information security management system.
Scope: HEOSSI management-system scope to be formally defined
ISO/IEC 42001:2023
AI Governance & Safety
Planned framework for developing, operating and continually improving HEOSSI's AI management system.
Scope: HEOSSI AI governance and applicable AI systems
ISO/IEC 19790:2025
Cryptographic Module Security
Planned evaluation of technically applicable core cryptographic modules, with validation or conformity assessment pursued when an appropriate pathway is available.
Scope: Applicable cryptographic modules and their defined boundaries
Important: HEOSSI does not represent certification, validation or conformity assessment as complete until the relevant independent evidence has been issued. This is a management target, not a current assurance claim.
Certification Disclaimer: HEOSSI (PTE.) LTD. owns and administers the company compliance programme and is the prospective certificate holder. BEE, QNSI, and other HEOSSI solutions may be included within the documented organisational or technical scope; they are not separate certificate holders. Internal framework posture; accredited certification and independent conformity assessment are not currently claimed. ISO/IEC 19790 applies only to specifically identified cryptographic modules or components. ISO/IEC 27001 and ISO/IEC 42001 certification depends on implementation and successful independent audit. HEOSSI does not represent any outcome as complete until the relevant certificate or validation evidence has been issued.
Security & Compliance Framework
Production-grade security controls and compliance mappings designed for regulated environments.
Quantum Threat Model v2.0
Comprehensive threat modeling aligned with NIST PQC standards and CRQC timeline assumptions.
- 4 attacker classes: Script Kiddie → Nation-State with CRQC
- HNDL (Harvest Now, Decrypt Later) timeline modeling
- 15+ security controls mapped to specific threats
- Legacy migration milestones with staged classical deprecation
Cryptographic Attestation
Forensic-grade cryptographic evidence with NIST algorithm lifecycle tracking.
- NIST algorithm registry with lifecycle status
- CBOM (Cryptographic Bill of Materials) export
- Automated CNSA 2.0 and FIPS 140-3 compliance checks
- Machine-verifiable compliance snapshots with PQC signatures
Cryptographic Policy Engine
Tenant-configurable PQC enforcement with algorithm allowlists and HSM requirements.
- KEM: ML-KEM-512/768/1024
- Signatures: ML-DSA, Falcon-512/1024, SLH-DSA
- 4 policy tiers: Default → Government/Defense
- HSM-enforced root key protection
Key Compromise Response
Automated incident response for suspected or confirmed key compromises.
- 5-step remediation: record → rotate → rewrap → revoke → audit
- Automatic capability token revocation
- Sub-10s response target for critical incidents (subject to network conditions)
- Correlation tracking across services
Evidence & Compliance Artifacts
We organize and provide evidence in layers for institutional due diligence and regulatory inquiries.
Control Mappings
- ISO/IEC 27001:2022 control and evidence mapping
- ISO/IEC 42001:2023 AI governance and risk register
- ISO/IEC 19790:2025 module-boundary and test evidence where applicable
- Control-to-evidence register tailored to the assessed scope
Technical Artifacts
- Architecture diagrams (network, data flow, trust boundaries)
- CBOM (Cryptographic Bill of Materials) exports
- Telemetry samples (OpenTelemetry traces, metrics, logs)
- PQC algorithm lifecycle tracking reports
Operational Runbooks
- Incident response procedures (detection → containment → recovery)
- Disaster recovery and business continuity plans
- Change management workflows with approval gates
- Key compromise response playbooks (5-step remediation, target response times subject to conditions)
Audit Trails
- Merkle-anchored audit logs (tamper-evident)
- Policy decision records with cryptographic attestation
- Access control logs (who, what, when, why)
- Configuration change history with rollback capability
Requesting Compliance Evidence
If you are conducting due diligence or regulatory review, we can provide relevant materials under NDA and scope.
Initial Contact
Reach out with your scope and timeline
NDA & Scoping
Execute NDA and define evidence requirements
Secure Delivery
Access artifacts via secure data room
Regulatory Timeline & Mandates
HEOSSI is engineered to meet upcoming regulatory deadlines, not react to them. Our PQC-native architecture and compliance-first design position us ahead of the regulatory curve.
Hover or click nodes to explore regulatory connections • Lines show framework relationships
PQC
Post-Quantum Cryptography
7 regulations
Digital Assets
Digital Assets & Blockchain
4 regulations
Financial
Financial Resilience
3 regulations
AI
AI Governance
8 regulations
Data
Data Sovereignty & Privacy
3 regulations
Why HEOSSI for Regulated Environments
We don't retrofit compliance. We architect systems that must not fail in adversarial, regulated, and mission-critical contexts.
Built for adversaries, not convenience
Defense-in-depth architecture assuming breach. Least-privilege access, zero-trust networking, and cryptographic attestation at every layer.
Evidence-grade telemetry by default
OpenTelemetry instrumentation with Merkle-anchored audit trails. Every workflow emits forensic-grade artifacts for compliance and incident response.
Sovereign deployment models
Air-gapped, on-prem, and private cloud options with customer-controlled HSMs. No vendor lock-in, no data exfiltration, no compliance compromises.
PQC-native from day one
NIST-finalized post-quantum cryptography (ML-KEM, ML-DSA, SLH-DSA) in production. CNSA 2.0 compliant with automated algorithm lifecycle management.
Regulatory Compliance Disclaimer: Regulatory frameworks (MAS TRM, MiCA, DORA, FATF, GDPR, CNSA 2.0) are subject to ongoing interpretation, updates, and jurisdictional variations. Compliance alignment is based on current understanding of published regulations and may require adjustment as regulatory guidance evolves. HEOSSI maintains ongoing monitoring of regulatory developments and adapts controls accordingly.