FPT SoftwareFHNCertificationsReference architectures
Talk to NGT
DevSecOps · 02 of 5

Cloud security & compliance

Five control domains, the frameworks we design controls against and everything as code.

Cloud Security Controls
01

Five control domains on every account

The cloud's own services first, partner tools where they add something. Every finding lands in one view.

Cloud Security Controls
federationfindingsSecurity managementIdentity & accessApplication securityData securityCloud infrastructure securityCyber defence · an outside-in viewAWS Config & SCPscompliance as codeAWS Security Hubone view of findingsSecurity assessmentbefore go-liveAWS ManagedMicrosoft ADuser storeIAM Identity CenterSSO · MFAPrivileged accesstime-boxedPipeline rolesone eachAmazon CloudFrontDDoS protectionAWS WAFOWASP rulesAmazon API Gatewayauth · throttlingAWS Secrets Managerapp secretsIn transitTLS everywhereAWS KMSat restAccess by roleper projectAmazon VPCsecurity zonesAWS Network Firewallinspected trafficAWS Systems Managerhardened imagesAWS CloudTrailaudit trailAmazon GuardDutySIEMInvestigationroot causePlaybooksautomated responsePenetration testsplannedAmazon Inspectorvulnerability mgmtEndpoint securitypartner tools

Point at a component to light its links; select it for what it does here and the practice that makes it right on AWS.

Point at a component to see what it does; select it for the best practice.Open the architecture
02

Frameworks we design controls against

The controls we build, check and evidence for each, on client platforms.

FrameworkWhere it comes upHow it shows in the platform
ISO/IEC 27001Most enterprisesAccess, logging and change control as policy, evidenced from the pipeline
NISTUS-facing and public sectorControl baselines mapped to cloud policies, checked continuously
SOC 2SaaS providersAutomated policy enforcement and audit-ready reports
PCI DSSPayments and lendingSegmented networks, firewalls, anti-malware, logging everywhere
HIPAA / HITRUSTHealthcareCompliant services only; every change through reviewed CI/CD; scanning and SIEM
GDPREU personal dataClassification, encryption and access by role, with an audit trail
CIS BenchmarksHardening baselinesBenchmarked images and configuration, monitored for drift
OWASPWeb and API appsSecure-coding checklist, dependency checks and ZAP scans in the pipeline
Frameworks, not certificates

The certification or attestation belongs to the client. NGT's own projects follow FPT Software's information-security risk process, mapped to ISO/IEC 27001:2022 Annex A.

03

ClickOps or everything as code

Manual change (ClickOps) Everything as code
Infrastructure changeBy hand in the console; nobody knows what changedTerraform through a reviewed pipeline; the plan is the record
AccessShared accounts, long-lived keysSingle sign-on, a role per pipeline, access that expires
PolicyA document on a wikiPolicy as code, checked on every deploy
AuditScreenshots the week before the auditApprovals, scans and deploys logged automatically
DriftFound during an incidentMonitored continuously, raised as findings
Disaster recoveryA runbook nobody has triedEnvironments rebuilt from code by the pipeline
SourcesNGT Service Offering v2.0 (Mar 2025)NGT Service Offering v3.2 (Jul 2026)NGT DevSecOps & Cloud Security Service Offering v0.4 (Jan 2025)NGT Cloud Operations Service Offering v0.2 (Jan 2025)NGT Cloud/DevOps/SRE Service Offering (Sep 2026)NGT DevOps-AI Service Offering (Oct 2026)