EHEPS Technology Service Register
EHEPS Technology Register
Technology governance, security and service dependencies
Document version 1.0
Status: Draft — Verification Required

Technology Service Register

Centralized service inventory covering cloud infrastructure, software platforms, APIs, identity systems, integrations, security controls, service dependencies and applicable policies.

Verification notice: This register is an administrative record and planning framework. Historical configurations must be independently verified before being classified as active. Listing a provider does not establish an account, partnership, certification or product approval.
0 Registered services
0 Reported active / configured
0 Planned / under evaluation
0 Verification / review required

1. Service-by-Service Inventory

Search by provider, service, API, lifecycle status, risk or policy. Records below are initial classifications, not live account checks.

Provider Service / Component Lifecycle status Dependencies Risk Security / Data Requirements Applicable Policies

2. Service Dependency Register

Service Depends on Information exchanged Required control Dependency status
WordPress Hosting, DNS, database, TLS Website content and configuration Admin access control, backups, TLS Verify
WordPress MCP WordPress REST API, OAuth Approved website content and metadata Least privilege, read-only default Verify
Google Cloud IAM, billing, APIs, networking Cloud resources and service data IAM review, audit logs, encryption Verify
BigQuery Google Cloud IAM, datasets, billing Analytical datasets Dataset permissions and retention Planned / verify
Firebase Google Cloud project, authentication, database rules Application identity and records Authentication rules and database security Verify
OAuth / OpenID Connect Identity provider, registered clients, redirect URIs Authentication tokens and identity claims Token security, exact redirect URI validation Verify
External APIs Provider account, credentials, network access API request and response data Secret Manager or approved secret storage Per integration

3. Security Control Register

Control ID Security control Requirement Evidence Review status
SEC-001 Identity and access management Least privilege and individual accounts IAM policy review Required
SEC-002 Multi-factor authentication Enable for privileged accounts where supported Account security settings Verify
SEC-003 Encryption in transit HTTPS and TLS for supported connections TLS configuration and certificate records Verify
SEC-004 Encryption at rest Review provider encryption and key-management settings Storage and database configuration Verify
SEC-005 Credential management No API keys, passwords or tokens in public source code Secret inventory and access review Required
SEC-006 Audit logging Record security-relevant administrative changes Provider audit logs Verify
SEC-007 Backups and recovery Document backup scope and recovery testing Backup and recovery evidence Verify
SEC-008 API security Authenticate, authorize, validate and monitor API access API configuration and test records Required
SEC-009 Change management Require review and approval before production changes Change request and approval log Required

4. IAM, OAuth, API and Integration Records

Record Technology Security requirement Evidence to retain Status
ID-001 Google Cloud IAM Least-privilege roles; avoid unnecessary owner permissions Role bindings and review date Verify
ID-002 OAuth 2.0 Validate scopes, redirect URIs, tokens and client access Client configuration and scope list Configured — verify
ID-003 OpenID Connect Validate issuer, audience, signature and nonce Discovery metadata and test results Under evaluation
API-001 WordPress REST API Restrict write operations and authenticate requests Endpoint and permission inventory Verify
API-002 WordPress MCP Read-only operation by default Available tools and access scopes Configured — verify
API-003 Google Cloud APIs Enable only approved APIs and review service identities API inventory and IAM records Per project
API-004 Third-party integrations Review data sharing, authorization and vendor terms Integration agreement and test record Per integration

5. Risk Classification and Data Protection

Risk Example Data protection requirement Review requirement
High Privileged IAM, production credentials, sensitive records Restricted access, strong authentication, encryption, audit logs Before access or configuration changes
Medium Application integrations, operational datasets Purpose limitation, access restrictions, retention controls Before integration and periodically
Low Public policy pages and non-sensitive documentation Accuracy, integrity, accessibility and publication review Before publication and when updated

Data categories

  • Public: Approved public information and published policies.
  • Internal: Operational documentation not intended for public distribution.
  • Confidential: Non-public business, personnel or administrative information.
  • Restricted: Credentials, authentication secrets and highly sensitive records.

Classification must reflect actual data and applicable law. Do not place passwords, API keys, access tokens or private keys in this register.

6. Applicable Policies and Standards

The following links connect service records to governance documents. Policy links are references to documents, not proof of legal compliance.

EHEPS policy documents

Official technology-provider policies and standards

Google Privacy Policy Google privacy practices Google Cloud Terms Google Cloud contractual terms Google Cloud Service Terms Product-specific service terms IBM Privacy IBM privacy information IBM Terms IBM terms and conditions AWS Privacy Amazon Web Services privacy information AWS Service Terms AWS service-specific terms AWS Acceptable Use Policy AWS acceptable use requirements OpenID Foundation Policies Foundation policies and governance OpenID Connect Core Identity protocol specification RFC 8692 Cryptographic algorithm identifiers

7. Change Management and Governance

  1. Register each new service before production integration.
  2. Identify the service owner and business purpose.
  3. Record dependencies, data categories and provider terms.
  4. Assess risk and applicable security controls.
  5. Review IAM roles, OAuth scopes and API permissions.
  6. Obtain required authorization before implementation.
  7. Retain configuration evidence and approval records.
  8. Review service status periodically and when material changes occur.
Production protection rule: This register does not authorize deployment, publishing, API activation, billing commitments, permission changes, credential creation or transfer of production data. Each such action requires separate approval.

Record ownership fields

  • Service owner and responsible administrator
  • Provider and product name
  • Service purpose and environment
  • Lifecycle status and last verification date
  • Data classification and risk rating
  • Dependencies and applicable policies
  • Evidence reference and reviewer approval
  • Next review date and change history
EHEPS Technology Service Register

Version 1.0 · Draft — Verification Required · Document owner: EHEPS administration

This register is an administrative governance document. Provider references do not imply endorsement, partnership, membership, certification or approval.

Powered by CookieAdmin

Share with

Twitter/XPinterestRedditMastodonThreadsEmailPrintFlipboardFlipboardHacker NewsLineWeChatSnapchatMixMixPocketGoogle MessagesSMSTumblrTumblrXingXINGVKVKontakteBufferBufferYummlyNextdoorGrocyGabFacebookWhatsAppLinkedInTelegramMessengerBluesky