Feedback integration certs

[ipatka]

Revise SFC certifications, add Identity & Accounts, retire Workspace Security

Mirrors the cert revisions applied in SEAL-Certs-Template (feedback-integration-1.1) into the live frameworks site, plus a few UX improvements: control IDs are now visible in the card UI, per-cert version stamps render in the page header, and a central /certs/changelog aggregates revision history.

The old SFC Workspace Security cert is retired — its crypto-relevant content (org accounts, phishing-resistant MFA, credential management, account lifecycle, takeover monitoring) is consolidated into a new horizontal SFC Identity & Accounts cert. Everything else that was in Workspace Security (device management, EDR/MDM, BYOD, physical/travel security, formal training programs, insider threat, data classification) is intentionally dropped as out of SEAL SME and better covered by ISO 27001 / SOC 2 / CIS.

Highlights

• New cert: SFC Identity & Accounts (8 controls). Horizontal scope; other certs reference it for account-control concerns.
• Retired: SFC Workspace Security. Replaced by Identity & Accounts for the parts that matter; the rest intentionally dropped.
• Existing certs revised based on reviewer feedback (see per-cert sections below). All five go v1.0 → v1.1.
• UI: control IDs visible in each control card (ms-2.1.2 · Contract-Level Security Controls). Data was already there; now surfaced.
• Versioning: version and revised frontmatter fields stamp each cert; rendered inline near the title with a link to the new /certs/changelog page.
• Dedup: account-control pattern (MFA, credentials, reviews, lifecycle) de-duplicated out of DNS/DevOps/Treasury/IR. Identity & Accounts is the authoritative source; verticals reference it and keep their domain specifics.

Commits

1. da9b0ad — Port cert revisions + create sfc-identity-accounts.mdx
2. 9fc43e7 — Retire Workspace Security (delete file, sidebar, all cert-list references, build-time scripts)
3. 92740e4 — Surface control IDs in the card UI
4. f8bdd5d — Per-cert version stamps + central /certs/changelog page
5. 9b5d72d — Regenerate build artifacts (index.mdx, fetched-tags.json)

Changes by cert

SFC Multisig Operations (v1.0 → v1.1)

• ms-2.1.2: "evaluate" → "implement" contract-level security controls
• ms-4.1.1: transaction process consolidated 8 → 5 bullets

SFC Treasury Operations (v1.0 → v1.1, 20 → 22 controls)

• Scope note: internal vs professional treasury ops
• tro-1.1.4: "SLAs" → "timeframes"
• tro-2.1.1: impact thresholds reframed as example scheme
• tro-2.1.2: renamed to "portfolio concentration limits"
• tro-2.1.3 (NEW): per-actor and per-path exposure limits
• tro-3.1.1: session-timeout phrasing clarified; geo restriction clause dropped
• tro-3.1.2: hardware-key MFA for privileged credential access; owner/admin-isolation moved to tro-3.1.5
• tro-3.1.5 (NEW): privileged access and root account management
• tro-4.1.1: trusted-parser bullet added; 8 → 5 bullets
• tro-4.1.2: 4 → 3 bullets
• tro-5.1.1: "TVL history" and "insurance coverage" dropped from baseline; exposure limits softened
• tro-6.1.1: 9 → 4 bullets
• tro-6.1.2: 7 → 4 bullets
• Header pointer to SFC Identity & Accounts

SFC DevOps & Infrastructure (v1.0 → v1.1, 16 → 17 controls)

• di-1.1.2: supply-chain mention softened (cross-references Section 2)
• di-1.1.4: narrowed to the evaluation process
• di-1.1.5 (NEW): approved tools list
• di-2.1.1: access review cadence tightened; account controls reference I&A
• di-2.1.4: 6 → 3 bullets
• di-3.1.1: runner hardening bullet added; 6 → 5 bullets
• di-4.1.1: network architecture bullet added (segmentation, minimal public exposure, firewall/security group rules)
• di-4.1.2: account controls reference I&A; break-glass bullets consolidated
• New References section at bottom (Cloud Security Alliance CCM, cloudsecdocs.com)

SFC DNS Registrar (v1.0 → v1.1, no count change)

• dns-3.1.1: slimmed to reference SFC Identity & Accounts for account controls; DNS-specific registrar RBAC bullet retained

SFC Incident Response (v1.0 → v1.1, no count change)

• Header pointer to SFC Identity & Accounts
• ir-1.1.1: 7 → 3 bullets
• ir-1.1.2: 7 → 4 bullets
• ir-2.1.2: 8 → 4 bullets
• ir-5.1.1: 7 → 4 bullets

SFC Identity & Accounts (NEW, v1.0, 8 controls)

• ida-1.1.1 Owner
• ida-1.1.2 Org account inventory (social media, email, SSO, registrar, custody, repo admin, cloud root, SaaS)
• ida-2.1.1 Phishing-resistant MFA (FIDO2/WebAuthn for high-privilege; no SMS/voice as primary for high-privilege)
• ida-2.1.2 Password manager and individual accountability
• ida-2.1.3 Recovery methods restricted to org channels
• ida-3.1.1 Account lifecycle (24-hour offboarding across all org accounts; periodic reviews)
• ida-4.1.1 Account takeover and credential exposure monitoring
• ida-4.1.2 Third-party access management

Ancillary changes

• vocs.config.tsx: sidebar — Workspace Security removed, Identity & Accounts added, Changelog page linked
• components/cert/ControlCard.tsx + control.css: control ID rendered inline with muted separator
• components/certified-protocols/CertifiedProtocols.tsx: certTypeToName map updated (sfc-ida replaces sfc-ws)
• utils/generate-cert-data.js: CERT_ORDER — I&A in, Workspace out (powers the "Export All Certifications" xlsx on the overview page)
• utils/generate-printable-checklists.js: CERT_META — I&A in, Workspace out (powers the Print button per cert)
• docs/pages/certs/overview.mdx, docs/pages/certs/index.mdx, docs/pages/intro/overview-of-each-framework.mdx: cert lists updated

Workbook compatibility

• Control IDs are stable across this revision. No renames.
• Baseline text changes don't affect workbook import (import reads by Control ID).
• New controls (tro-2.1.3, tro-3.1.5, di-1.1.5, all ida-*) simply won't be populated from old workbooks, which is expected.
• Users with saved localStorage state for Workspace Security lose that state (that cert is removed). Other certs retain state.
• cert-data.json and printable/*.html are gitignored and regenerate at build time — no manual action needed on deploy.

Review checklist

• I&A scope feels right (account management in; device/physical/training/insider-threat intentionally out)
• Dedup pattern across vertical certs keeps each readable standalone
• Simplified baselines still carry enough specificity to be testable
• Versioning mechanic (frontmatter + inline render + changelog page)
• Control ID display placement works; if not, easy CSS tweak

Related

This PR mirrors security-alliance/SEAL-Certs-Template#feedback-integration-1.1. Per-control reasoning and declined feedback items are captured there under _feedback/review-*.md.

[github-actions]

Sidebar Configuration Reminder

This PR includes added, renamed, or removed documentation files:

• docs/pages/certs/changelog.mdx (added)
• docs/pages/certs/sfc-identity-accounts.mdx (added)
• docs/pages/certs/sfc-workspace-security.mdx (removed)

Please ensure that:

• The sidebar in vocs.config.tsx has been updated to include these files
• New content has the dev: true parameter so it's marked as under development
• Sidebar links match the file paths - use the preview deployment to verify

See Contributing Guide – Sidebar & Navigation for more details.

---

_{This is an automated reminder. If this PR doesn't need sidebar changes, you can ignore this message.}

[github-actions]

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
frameworks	✅ Ready (View Log)	Visit Preview	9698956

[DicksonWu654]

LGTM! LFG!!

[frameworks-volunteer]

Model: z-ai/glm-5.1 Reasoning: high Provider: openrouter

Review Summary

Security: clean. No secrets, injection vectors, or unsafe patterns. The ControlCard change renders control.id from frontmatter (not user input), so no XSS surface. No new dependencies.

QA: one inconsistency worth fixing, otherwise solid.

Inconsistency: IR control ID renames vs "No renames" claim

The PR description states: "Control IDs are stable across this revision. No renames." However, IR Section 2 IDs are explicitly renamed by this PR:

• ir-2.1.1 → ir-2.1.2 (Monitoring Coverage)
• ir-2.1.2 → ir-2.1.3 (Alerting, Paging, and Escalation)
• ir-2.1.3 → ir-2.1.4 (Tamper-Evident Logs)

The new ir-2.1.1 (Threat Model for Protocol Operations) inserts before them, shifting all three. The changelog body correctly captures this in the workbook compatibility section, but the PR description's "No renames" claim is misleading and should be updated. Protocols using workbooks with saved IR Section 2 data will need manual re-mapping.

What looks good

• Identity and Accounts cert is well-scoped: horizontal account-management pattern, clear dedup from vertical certs, explicit scope boundaries (device/physical/training intentionally out)
• Threat model control (ir-2.1.1) is a strong addition -- anchors monitoring to known threats
• Overview page rewrite is clearer: drops stale RFC language, separates protocol vs auditor sign-ups (CertsWaitlist vs CertsAuditor)
• Versioning mechanic (frontmatter + inline render + changelog page) is clean and extensible
• Control ID display in ControlCard is minimal and useful
• All internal links use clean paths without .mdx extensions
• Workspace Security retirement is handled thoroughly: file deleted, sidebar updated, all references removed, cert-type maps updated, changelog documents what moved vs what was dropped