- Inheritance is per control, not per system.
- Most assessment findings arise from shared controls.
- Begin with the control responsibility matrix rather than the full control catalog.
Three categories of control
Teams often assume each control is either inherited or their own. In practice, there are three categories, and the shared category requires the most attention.
Fully inherited controls are satisfied entirely by the hosting platform. Physical access is the clearest example: ServLogi implements PE-3, and our evidence covers it.
Customer controls are entirely your responsibility. For example, a hosting provider cannot implement your application's authorization logic.
Shared controls are implemented partly by the hosting platform and partly by you. AC-2, account management, is shared: ServLogi manages platform accounts, and you manage application accounts. Your assessor will require evidence for both, and a gap on your side is a finding even though the control appears in our authorization package.
Use the responsibility matrix
Your onboarding package includes a control responsibility matrix that identifies, control by control, which category applies. We recommend starting there rather than working through the full NIST catalog.
For each control marked shared or customer, document what you implement and where the evidence is kept. Doing so as you build is far more efficient than reconstructing it before an assessment.
Controls that require particular attention
- AU-2 and AU-6. ServLogi retains platform audit records. You are responsible for generating, retaining, and reviewing your application's audit records.
- CM-6. Your operating system configuration is your responsibility. The inherited baseline extends to the virtualization layer.
- IA-2. ServLogi manages platform authentication. You manage application authentication, including multi-factor authentication for privileged users.
- CP-9. ServLogi provides durable storage. You are responsible for backing up your data and confirming that restores work.
- SI-2. ServLogi patches firmware and virtualization software. You patch your operating system and applications.
Even when a control appears in our authorization package, your assessor may still ask about it. Inheritance reduces your workload but does not eliminate the discussion.
Requesting evidence
Evidence packages for inherited controls are available through the Client Portal under Compliance. Assessment reports are available under a non-disclosure agreement. We recommend requesting both early, as assessors typically ask for them at the start of fieldwork.