Skip to main content
Enigm maintains a formal information security governance model intended to support security, privacy, operational resilience, and continuous improvement. This document describes Enigm’s public governance, compliance, and assurance approach for enterprise customers, security auditors, technical partners, security engineers, and procurement teams.

​
Overview

Enigm security assurance is based on governance, risk management, security controls, assessment, and continuous improvement. The diagram is conceptual and describes the assurance lifecycle at a public governance level.

​
Security Governance

Enigm security governance defines how security responsibilities, oversight, and review processes are managed. Governance includes:
  • Defined security responsibilities.
  • Security oversight.
  • Governance processes.
  • Security review processes.
  • Accountability for risk decisions.
  • Review of security-relevant changes.
Security governance is intended to support consistent decision making and ensure that security remains part of product, platform, and operational planning.

​
Risk Management

Security risks are identified, evaluated, prioritized, and addressed through structured risk management processes. Risk management may include:
  • Identification of security risks.
  • Evaluation of likelihood and impact.
  • Prioritization according to risk.
  • Remediation planning.
  • Verification of remediation where applicable.
  • Periodic reassessment.
Risk management supports security governance by ensuring that findings, control gaps, and exposure risks are reviewed according to their security relevance.

​
Information Security Management

Enigm operates an information security management framework designed to support:
  • Confidentiality.
  • Integrity.
  • Availability.
  • Risk management.
  • Continuous improvement.
The information security management framework provides structure for security governance, control review, assurance activities, and compliance program operations.

​
Compliance Program

Enigm maintains ISO 27001 certification. The certification supports structured information security governance, risk management, control review, and periodic assessment. This public documentation references the certification without publishing internal audit records, certification identifiers, or assessment evidence. The compliance program is designed to support:
  • Information security governance.
  • Security policy oversight.
  • Risk management.
  • Control validation.
  • Periodic assessment.
  • Continuous improvement.
Public documentation summarizes the compliance model without publishing restricted assessment materials.

​
Independent Assessments

Enigm performs independent and recurring security assessment activities. Assessment activities may include:
  • Periodic security assessments.
  • Vulnerability assessments.
  • Adversarial security testing.
  • Security control reviews.
  • Infrastructure exposure reviews.
  • Security posture validation.
  • Configuration reviews.
These activities are intended to identify vulnerabilities, misconfigurations, control gaps, and exposure risks across supported environments.

​
Security Reviews

Security posture is reviewed on a recurring basis. Security reviews may evaluate:
  • Security findings.
  • Control effectiveness.
  • Configuration posture.
  • Exposure risks.
  • Remediation progress.
  • Security-relevant changes.
Findings are prioritized according to risk and addressed through remediation processes. Remediation activities are tracked and verified where applicable.

​
Cryptographic Assurance

Enigm incorporates post-quantum cryptographic algorithms standardized by NIST as part of its cryptographic architecture. Cryptographic controls are reviewed as part of the broader security assurance program. Cryptographic assurance may include:
  • Review of cryptographic architecture.
  • Review of key management models.
  • Review of algorithm selection.
  • Review of platform integration boundaries.
  • Review of lifecycle and rotation considerations.
References to NIST are limited to standardized cryptographic algorithms and recognized security guidance.

​
Continuous Improvement

Security governance includes:
  • Ongoing review.
  • Control validation.
  • Security monitoring.
  • Risk reassessment.
  • Program improvement.
  • Remediation verification.
  • Review of assessment outcomes.
Continuous improvement ensures that governance, security controls, and assurance activities evolve as the Enigm ecosystem, threat environment, and customer requirements evolve.

​
Security Limitations

Compliance, certification, and assessments improve confidence but do not eliminate security risk. Limitations include:
  • Certification does not guarantee the absence of vulnerabilities.
  • Assessments may not identify every weakness.
  • Security controls require ongoing validation.
  • Risk posture may change over time.
  • External systems may introduce risk outside Enigm control.
  • Governance cannot replace secure engineering, monitoring, incident response, or user security awareness.
Security remains an ongoing process rather than a static state.