Regulatory alignment by design.

TrueSign satisfies the two-factor inherence/possession composition by binding a hardware-attested signing key to a deterministic intent message. Dynamic linking is enforced cryptographically: the signature commits to payee, amount, and currency, so post-authorization tampering is detectable by any verifier.

Layered security and transaction-level authentication for high-risk account activity are implemented through per-transaction cryptographic authorization, not session-bound MFA. Each authorization produces a non-repudiable artifact suitable for examiner reconstruction.

TrueSign meets AAL3 by requiring a hardware-bound cryptographic authenticator with verifier impersonation resistance and replay resistance. Authentication intent is established per authorization rather than per session.

Zero Trust requires per-request policy decision and continuous verification. TrueSign moves the trust boundary from the session to the transaction: every authorization is independently policy-evaluated, signed, and logged.

Section 500.12 multi-factor authentication and Section 500.06 audit trail obligations are satisfied with cryptographically verifiable evidence of who authorized what, when, and under which policy version.

Section 4 information security program requirements are supported by hardware-bound authorization, immutable audit trail, and incident-ready evidence preservation aligned with state insurance department examinations.

Requirements 8.4 (MFA), 8.5 (non-shared credentials), and 10.x (logging integrity) are addressed by per-action cryptographic authorization with a hash-chained ledger that detects log tampering.

Control families AC, AU, IA, and SC are mapped to TrueSign's authorization, audit, identity, and cryptographic boundary. Authorization package preparation underway under sponsor agency engagement; status updated as evidence is filed.

High-impact uplift includes additional SC and AU controls already addressed by hardware attestation and ledger-chained audit. Pursued subject to sponsor agency engagement following Moderate authorization.

Level 2 practices for IA, AC, and AU are met through hardware-bound authentication and immutable audit; Level 3 expectations regarding advanced persistent threat resilience are addressed by post-quantum hybrid cryptography on the authorization channel.

MAS TRM 14.x access control and 11.x cryptography expectations are met by hardware-rooted authorization keys, deterministic transaction binding, and verifiable audit trails suitable for MAS thematic reviews.

Chapter IV cryptographic controls and Chapter VI audit trail expectations are addressed by per-transaction cryptographic authorization with hash-chained ledger commitments.

Paragraphs 23 to 28 information security capability and incident management obligations are supported by cryptographic non-repudiation and rapid evidence reconstruction for APRA notification windows.

Common Criteria CC6 logical access and CC7 system operations controls are designed-in. Type II observation period preparation underway; report made available under mutual NDA upon issuance.

Annex A controls A.5, A.8, A.9, and A.12 are addressed by the authorization control plane and ledger. Statement of Applicability and certification engagement underway.

Article 5 data minimization is supported by signing intent, not personal data. Article 32 security of processing is met through hardware-rooted cryptography. Records of authorization decisions support Article 30 documentation obligations.

Verifiable consumer request workflows and recordkeeping for authorized actions are supported by tamper-evident logs. TrueSign does not sell personal information and supports purpose-limitation by design.