Movahedi Solutions
CIS Controls v8 and MVSP Alignment
This document is an alignment statement by 1000823315 ONTARIO INC., operating as Movahedi Solutions. It is a self-assessment, not an audit, not a certification, and not a third-party verification. Only items verified in the run are listed. Items not listed here are not claimed.
This document is a self-assessment. It is not a certification, not an audit, and not a third-party verification. Verified alignment items 16 total: 10 CIS Controls v8 at control level (Controls 1, 2, 3, 4, 5, 6, 9, 11, 15, 17) and 6 MVSP items (vulnerability reports, self-assessment, subprocessor list, HTTPS only, security headers, encryption in transit).
This document is an alignment statement by 1000823315 ONTARIO INC., operating as Movahedi Solutions. It is a self-assessment, not an audit, not a certification, and not a third-party verification.
Company: 1000823315 ONTARIO INC., operating as Movahedi Solutions, Mississauga, Ontario, Canada.
Contact: mohammad@movahedi.ca
Date: October 28, 2026
Scope: the public website movahedi.ca, and the handling of client material in engagements. This document does not cover a client system.
How to read this document: only items checked on the date shown are listed. Items not listed here are not claimed. Multi-factor authentication is enabled on the founder's email (Google Workspace), GitHub, and Cloudflare accounts (founder-confirmed, October 29, 2026). Automated backups, single sign-on readiness, and firm-wide data retention rules are not claimed here, because none of those was checked.
CIS Controls v8, Implementation Group 1
Alignment is stated at control level, for the controls listed below only. No other CIS control is claimed here.
| CIS Control | Verified alignment | Evidence |
|---|---|---|
| 1. Inventory and Control of Enterprise Assets | The public site scope is one site, movahedi.ca, with its delivery provider and build source named | Companion cybersecurity self-assessment, Identify section |
| 2. Inventory and Control of Software Assets | The site source is held in GitHub, giving a record of what was deployed | Companion cybersecurity self-assessment, Detect section |
| 3. Data Protection | Client data is used only for its engagement, access is limited, and client data is removed at the end or returned or deleted on client instruction; no sale and no model training | Companion cybersecurity self-assessment, Protect section |
| 4. Secure Configuration of Enterprise Assets and Software | Security headers in place, including Strict-Transport-Security with preload, and the site served over HTTPS | Security Headers scan, October 28, 2026; see Security Practices for the result |
| 5. Account Management | Access to the firm's own accounts and tools is limited to the people who need it for the work at hand | Security Practices document, Accounts and access section |
| 6. Access Control Management | Access is removed when a person no longer needs it for an engagement, as part of closing the engagement | Security Practices document, Accounts and access section |
| 9. Email and Web Browser Protections | Email authentication records published for the firm's domain: SPF, DKIM for the Google selector, DMARC at quarantine policy | DNS and SSL Checks, October 28, 2026 |
| 11. Data Recovery | The public site can be redeployed from its GitHub source after a correction, so recovery does not depend on a single live copy | Companion cybersecurity self-assessment, Recover section |
| 15. Service Provider Management | A subprocessor table is published, listing Cloudflare for delivery over HTTPS and GitHub for build and deployment, with no location stated where none was verified | Subprocessor Transparency Table, October 28, 2026 |
| 17. Incident Response Management | A published method exists for reporting a security issue on the public site, with scope limited to movahedi.ca, and a published handling sequence through the site source and redeployment | Responsible Disclosure page; companion cybersecurity self-assessment, Respond section |
CIS controls aligned: 10, at control level.
Minimum Viable Secure Product (MVSP)
Alignment is stated for the MVSP checklist items listed below only. No other MVSP item is claimed here.
| MVSP item | Verified alignment | Evidence |
|---|---|---|
| Vulnerability reports | A published contact and method for security reports on the public site, with a security.txt file prepared for https://movahedi.ca/.well-known/security.txt | Responsible Disclosure page; security.txt in this Trust Center set |
| Self-assessment | Security self-assessments are published in this Trust Center set, including this document, the CAIQ-Lite self-assessment, and the NIST CSF matrix self-assessment, each dated October 28, 2026 | Documents in this Trust Center set |
| Subprocessor list | A subprocessor table is published for the public website, with engagement tools agreed per engagement rather than presented as a single standing list | Subprocessor Transparency Table, October 28, 2026 |
| HTTPS only | The public site is served over HTTPS through Cloudflare | DNS and SSL Checks, October 28, 2026; SSL Labs grade A, assessed October 28, 2026, 01:00:26 UTC |
| Security headers | Security headers in place, including Strict-Transport-Security with preload | Security Headers scan, October 28, 2026; see Security Practices for the result |
| Encryption in transit | The public site is served over HTTPS, and SSL Labs returned grade A on all four endpoints tested | https://www.ssllabs.com/ssltest/analyze.html?d=movahedi.ca |
MVSP items aligned: 6.
Summary
Total alignment items verified: 16 (10 CIS Controls v8 control-level alignments and 6 MVSP items).
Limits: this document does not claim a company certification, a penetration test, a monitoring platform, a response time, or an availability figure. It does not cover a client system. Founder credentials (ISC2 CC, CIPP/C, Lean Six Sigma coursework (LinkedIn Learning, 2022)) are personal only and are not company certifications.
Related pages
Scope and limits, stated briefly
Where a matter is to be confirmed per engagement, it is stated as such, and it is confirmed in writing for that engagement before work starts. Contact: mohammad@movahedi.ca.