Dedicated Iron Fort infrastructure

• Confirm the AWS region, including Canadian residency if that is a requirement you have to evidence.
• Agree the encryption posture: a KMS key scoped to you alone, and who may administer it.
• Collect your egress ranges. Get these from the network team, not from a spreadsheet — stale ranges are the most common cause of a day-one lockout.

Done whenRegion, key policy and allowlist are agreed in writing.

• We provision a dedicated VPC, a dedicated database and evidence bucket, and your KMS key.
• Data subnets are created with no route to the internet.
• The application is deployed behind a WAF configured to admit only your ranges.

Done whenA request from an allowlisted address succeeds; one from anywhere else is refused at the edge.

• Administrators sign in with Microsoft or Google, two-factor enforced. There is no local password path.
• Test from every location your team actually works from, including home VPN egress.
• Agree the change process for adding an address range later, so it does not become a ticket nobody owns.

Done whenEvery person who needs access has it, from every network they use.

• The single managed scanner worker inside your VPC is the only component that reaches your systems.
• Grant read-only credentials as in Pattern 1 — CloudFormation stack, app registration, service account, OAuth.
• Confirm the worker's egress is outbound only; nothing inbound to your network is required.

Done whenEvery in-scope system returns data on a test collection.

• Record the organisation and its systems; install the framework and choose a profile.
• Run the first collection and separate real gaps from scoping errors.
• Bulk-upload existing policies and set review cycles.

Done whenA coverage figure exists and every required policy has an owner and a review date.

• Schedule the recurring reviews and tag them to the frameworks they satisfy.
• Generate the assessor reports and read them before the assessor does.
• Publish the trust page — it is public by design, and separate from the allowlisted application.

Done whenThe programme runs without anyone touching infrastructure.