{ "$schema_description": "Machine-readable Secure Configuration Guide for the CARTN cloud service offering. Mirrors the human-readable guide at admin-guide.html so customers and third-party tools can programmatically compare recommended/default settings against the current configuration of their tenant.", "document": "CARTN Administrative & Privileged Account Documentation (Secure Configuration Guide)", "publisher": "Xfinion, Inc.", "maintainer": "Xfinion Customer Success Engineering (CSE)", "source_document": "admin-guide.html", "fedramp_authorization_id": "FR2628943664", "version": "1.0.0", "last_updated": "2026-07-28", "changelog": [ { "version": "1.0.0", "date": "2026-07-10", "summary": "Initial publication of the machine-readable Secure Configuration Guide, generated from the human-readable Admin Guide." } ], "account_types": [ { "id": "global-tenant-admin", "role": "Global / Tenant Admin", "capabilities": "Full administrative control over the customer's CARTN tenant: user role assignment, site and location management, integration configuration, and access to all asset and audit data across the tenant." }, { "id": "site-location-admin", "role": "Site / Location Admin", "capabilities": "Scoped administrative access limited to a specific facility or site within the tenant. Can manage users and asset configurations only within their assigned scope." }, { "id": "standard-user", "role": "Standard User", "capabilities": "Operational access to track, locate, and manage assets. No configuration or administrative permissions within CARTN." } ], "cse_configurable_settings": [ { "id": "customer-tenant-provisioning", "setting_name": "Customer Tenant Provisioning", "security_implication": "Incorrect tenant configuration — particularly malformed IDP federation metadata or overly permissive group-to-role mappings — can grant unintended users access to a customer's CARTN environment. Tenant settings must be validated against the customer's signed configuration agreement before activation." }, { "id": "idp-federation-configuration", "setting_name": "IDP Federation (SAML / OIDC) Configuration", "security_implication": "Misconfigured SAML or OIDC settings — such as accepting assertions from untrusted issuers, disabling signature validation, or using weak encryption — can allow authentication bypass or token forgery. Federation metadata must be sourced directly from the customer's IDP administrator and verified before being applied." }, { "id": "api-key-management", "setting_name": "API Key Management", "security_implication": "API keys grant programmatic access to CARTN data and integration endpoints. Long-lived or over-scoped keys represent a persistent risk if compromised. Keys must be scoped to the minimum required permissions, stored in a secrets manager (not in code or configuration files), and rotated on a defined schedule or immediately upon suspected compromise." }, { "id": "data-retention-configuration", "setting_name": "Data Retention Configuration", "security_implication": "Retention periods govern how long asset tracking data and audit logs are stored. Setting them shorter than required by a customer's compliance obligations may destroy evidence needed for audit or incident investigations. Setting them excessively long may conflict with data minimization requirements. Retention settings must be reviewed against contractual and regulatory obligations before modification." }, { "id": "encryption-key-management", "setting_name": "Encryption Key Management", "security_implication": "Encryption keys protect customer data at rest. Loss or improper rotation of keys can result in irrecoverable data loss. Key material must be managed through Xfinion's designated key management service, with rotation performed per policy and dual-control procedures applied to all key lifecycle operations." }, { "id": "audit-logging-configuration", "setting_name": "Audit Logging Configuration", "security_implication": "Audit logs provide the evidentiary record for security monitoring, incident response, and compliance validation. Disabling or truncating audit logging eliminates visibility into potentially malicious activity. Log destinations must be write-protected so that no administrative account can delete or modify log records after they are written." }, { "id": "service-account-configuration", "setting_name": "Service Account Configuration", "security_implication": "Service accounts used for automated processes must operate under least-privilege principles. Over-privileged service accounts can be exploited to escalate access or exfiltrate data if compromised. Service accounts must not be shared with human users, and their credentials must be rotated on schedule or immediately upon personnel changes." } ], "customer_admin_okta_settings": [ { "id": "mfa-policy", "setting_name": "MFA Policy", "security_implication": "If MFA is not enforced in Okta, a compromised password is sufficient to gain CARTN access, including with administrative privileges. Customers must enforce MFA for all users who will access CARTN, and should require phishing-resistant MFA (FIDO2/WebAuthn) for accounts with Global/Tenant Admin or Site/Location Admin roles.", "recommended_configuration": "Enforce MFA for all users. Require phishing-resistant MFA (FIDO2/WebAuthn) for any account assigned to a Global/Tenant Admin or Site/Location Admin role. Note: Xfinion will not activate a customer's CARTN federation until MFA enforcement is confirmed." }, { "id": "okta-group-to-cartn-role-mapping", "setting_name": "Okta Group-to-CARTN Role Mapping", "security_implication": "The Okta groups mapped to CARTN roles determine what permissions each user holds. Assigning too many users to the Global Admin-mapped group violates least privilege and increases the blast radius of a compromised account. Role-to-group mappings should be reviewed at least quarterly.", "recommended_configuration": "Limit Global/Tenant Admin group membership to the minimum number of individuals required. Use Site/Location Admin roles for facility-scoped personnel. Certify group memberships at least quarterly and remove stale assignments promptly." }, { "id": "session-lifetime-idle-timeout", "setting_name": "Session Lifetime / Idle Timeout", "security_implication": "Excessively long Okta session lifetimes increase the window during which a stolen session token can be exploited. CARTN respects the session lifetime enforced by Okta and does not independently re-authenticate users.", "recommended_configuration": "Set idle session timeout to 15 minutes or less for accounts assigned to administrative roles. Maximum absolute session lifetime should not exceed 8 hours. Apply a separate, stricter sign-on policy to users in CARTN admin-mapped groups." }, { "id": "conditional-access-sign-on-policies", "setting_name": "Conditional Access / Sign-On Policies", "security_implication": "Okta Sign-On Policies can restrict authentication to known IP ranges, managed devices, or specific geographic regions. Applying these restrictions to the CARTN Okta application reduces exposure from stolen credentials used from unexpected locations or unmanaged devices.", "recommended_configuration": "Restrict the CARTN Okta application to managed, compliant devices and known corporate IP ranges. Enable device trust for privileged role holders. Apply network zone restrictions where feasible." }, { "id": "user-account-lifecycle-deprovisioning", "setting_name": "User Account Lifecycle (Deprovisioning)", "security_implication": "Failure to promptly deprovision departing employees from CARTN-linked Okta groups allows former employees to retain CARTN access, potentially at an administrative level.", "recommended_configuration": "Integrate Okta with the organization's HR system to enable automated deprovisioning. Establish a same-day offboarding process that removes departing employees from all CARTN-linked Okta groups and deactivates their Okta account." }, { "id": "saml-oidc-application-configuration", "setting_name": "SAML / OIDC Application Configuration", "security_implication": "The SAML or OIDC application configured in Okta for CARTN controls which assertion attributes and group claims are sent. An \"all users\" assignment must not be used for CARTN. Transmitting unnecessary claims increases data exposure and may cause unintended privilege grants.", "recommended_configuration": "Assign the CARTN Okta application to named groups only; never use \"Everyone\" or \"All Users.\" Transmit only the group-membership claim required by CARTN and omit all unnecessary attributes. Confirm assertion signing is enabled and the signing certificate is rotated on schedule." } ], "secure_by_default_controls": [ { "id": "encryption-at-rest", "control_name": "Encryption at Rest", "default_state": "Enabled (AES-256)", "configurable_by": "not-customer-configurable", "security_implication_if_changed": "All customer data at rest is encrypted by default using AES-256. Key material is managed through Xfinion's key management service with dual-control procedures. Disabling or weakening this control is not possible without Xfinion security team authorization." }, { "id": "encryption-in-transit", "control_name": "Encryption in Transit", "default_state": "Enforced (TLS 1.2+)", "configurable_by": "not-configurable", "security_implication_if_changed": "All API and web traffic is encrypted using TLS 1.2 or higher. Older protocol versions and unencrypted HTTP are rejected at the platform edge. This control is enforced at the infrastructure level and cannot be relaxed by any account class." }, { "id": "audit-logging", "control_name": "Audit Logging", "default_state": "Enabled & Immutable", "configurable_by": "xfinion-only-destination-and-retention", "security_implication_if_changed": "Security-relevant logging is enabled by default and covers authentication events, role assignment changes, administrative configuration actions, asset tracking operations, and integration activity. Log records are written to a write-protected destination; no administrative account can modify or delete entries after they are written. Logs are retained for a minimum period consistent with FedRAMP Low requirements and the tenant's configured data retention period. Disabling or truncating logging eliminates the evidentiary record required for incident response and compliance validation." }, { "id": "mfa-for-cse-top-level-admin-accounts", "control_name": "MFA for CSE (Top-Level Admin) Accounts", "default_state": "Enforced", "configurable_by": "not-customer-configurable", "security_implication_if_changed": "MFA enrollment is required before any top-level administrative access is granted. Microsoft Authenticator or a hardware FIDO2 token is required. This control cannot be waived for any CSE account and applies regardless of network location." }, { "id": "network-access-restriction-for-admin-interfaces", "control_name": "Network Access Restriction for Admin Interfaces", "default_state": "Enforced (VPN / Azure Bastion)", "configurable_by": "not-customer-configurable", "security_implication_if_changed": "CARTN administrative interfaces are not internet-reachable. A VPN or Azure Bastion session authenticated with Azure AD credentials and MFA is required. Removal of this control would expose infrastructure management interfaces to unauthenticated network access." }, { "id": "just-in-time-privilege-elevation-pim", "control_name": "Just-in-Time Privilege Elevation (PIM)", "default_state": "Enabled", "configurable_by": "xfinion-only", "security_implication_if_changed": "CSE elevated permissions are granted on a just-in-time basis for the duration of a specific task and expire automatically. Standing elevated access is prohibited. Disabling PIM would increase persistent privilege exposure for all CSE accounts." }, { "id": "role-based-access-control-via-okta-federation", "control_name": "Role-Based Access Control (via Okta Federation)", "default_state": "Enforced", "configurable_by": "cse-federation-mapping-and-customer-okta-group-assignment", "security_implication_if_changed": "All CARTN access requires a valid Okta assertion containing an authorized group claim. No anonymous, credential-based, or direct database access is permitted. CARTN does not maintain an internal user credential store; authentication is entirely delegated to the customer's Okta IdP." }, { "id": "no-default-passwords-no-internal-credential-store", "control_name": "No Default Passwords / No Internal Credential Store", "default_state": "Eliminated by design", "configurable_by": "not-configurable", "security_implication_if_changed": "CARTN does not maintain an internal user credential store and does not issue, accept, or store passwords for end users. All authentication is handled exclusively through the customer's Okta IdP via SAML 2.0 or OIDC. The absence of a credential store eliminates the risk of default or weak passwords granting unauthorized access. Customers cannot configure CARTN to accept credential-based authentication outside of the federated Okta flow." }, { "id": "mfa-prerequisite-for-federation-activation", "control_name": "MFA Prerequisite for Federation Activation", "default_state": "Enforced as activation gate", "configurable_by": "xfinion-activation-gate", "security_implication_if_changed": "Xfinion CSEs will not activate a customer's CARTN SAML/OIDC federation until the customer's Okta administrator confirms in writing that MFA is enforced for all users assigned to the CARTN application. This ensures the platform's MFA requirement is upheld even though authentication is delegated to the customer's IdP." }, { "id": "least-privilege-role-assignment-cse", "control_name": "Least-Privilege Role Assignment (CSE)", "default_state": "Enforced via approval workflow", "configurable_by": "xfinion-only", "security_implication_if_changed": "All CSE Azure AD role assignments require documented approval from a designated access approver. Roles are assigned at the minimum scope required and are reviewed periodically. Overly broad role assignments increase the blast radius of a compromised CSE account." }, { "id": "api-key-scoping", "control_name": "API Key Scoping", "default_state": "Least privilege required by policy", "configurable_by": "cse-per-provisioning-request", "security_implication_if_changed": "API keys are not issued with wildcard or administrative scopes. Each key is scoped to the minimum permissions required for its integration and stored in a secrets manager. Long-lived, over-scoped, or plaintext-stored keys represent a persistent risk if compromised." }, { "id": "shared-administrative-accounts", "control_name": "Shared Administrative Accounts", "default_state": "Prohibited", "configurable_by": "not-configurable", "security_implication_if_changed": "Each CSE holds an individual named account. Shared accounts are prohibited to ensure attribution and accountability in audit logs. All top-level administrative actions are traceable to a specific individual by design." }, { "id": "vulnerability-disclosure-policy-vdp", "control_name": "Vulnerability Disclosure Policy (VDP)", "default_state": "Published", "configurable_by": "n/a", "security_implication_if_changed": "Xfinion maintains a publicly available coordinated Vulnerability Disclosure Policy that authorizes good-faith security research and testing across all CARTN components, provides a clear reporting channel, and commits to not recommending legal action against good-faith researchers. The VDP ensures externally discovered vulnerabilities are reported and remediated in a structured, timely manner. See security-disclosure.html for details." } ] }