EDGE REGISTER

The Organizational Edge Is No Longer Only IP Space · Six Edge Types · Defend What’s Actually Reachable

Table of Contents

1. The Edge — What Changed
2. The Six Edge Types
3. Edge Management Model
4. Low-Control / High-Dependency Operating Model
5. Edge Register Operations
6. Document Control

1. The Edge — What Changed

For twenty years, “the organizational edge” meant the firewall. You knew what was inside and what was outside, and security’s job was to harden the perimeter.

That edge no longer exists in any useful form. Organizations operate across SaaS tenants, identity providers, vendor admin paths, MSP tooling, CI/CD dependencies, managed detection providers, cloud control planes, APIs, domains, certificates, subprocessors, and data egress paths. Each of these is a boundary across which trust, data, privilege, or control flows. Each of these is an edge.

The organizational edge is not a network diagram. It is the set of boundaries across which the organization’s security posture can be changed by someone outside the organization.

CERG maintains this Edge Register as the authoritative inventory of organizational edges. It is not a replacement for the TPRM procedure — it is the conceptual model that elevates third-party and supply-chain risk from “a procedure” to a first-class architectural concern. The TPRM procedure (CERG-PRC-TPRM-001) is the operational document that implements this model.

A program that truly knows its edge is less impressed by AI-powered attack branding. The edge doesn’t care whether the attacker used AI. It cares whether the path existed.

2. The Six Edge Types

2.1 Network Edge

The traditional perimeter — and still relevant. What is Internet-reachable? What VPNs, APIs, and remote-access paths exist?

2.2 Identity Edge

The most consequential edge in modern environments. Who can authenticate? What can they reach after authentication? What federated trust relationships exist?

2.3 SaaS Edge

Every SaaS tenant is an organizational edge. The organization’s data, identities, and configurations live inside a provider’s infrastructure.

2.4 Vendor Edge

Vendors and service providers with privileged access, remote connectivity, or administrative paths into organizational systems.

2.5 Software Supply Edge

Every dependency — open-source library, commercial SDK, CI/CD pipeline, build system — is a path through which malicious code can enter the organization.

2.6 Data Edge

Every path through which organizational data leaves the organization’s control — subprocessors, external data shares, outbound integrations, backup targets.

3. Edge Management Model

Every edge is managed through a common lifecycle:

Each edge type has its own discovery cadence, assessment criteria, control catalog, and monitoring signals. The table below summarizes the primary tooling and evidence for each type:

4. Low-Control / High-Dependency Operating Model

Not all edges can be controlled. Some can only be influenced, contracted, or monitored. CERG recognizes four control levels:

Operating at each level:

• Direct and Shared control environments follow standard CERG controls — baselines, scanning, change management, evidence collection.
• Contractual control environments require: security clauses in contracts, annual evidence collection (SOC 2, ISO 27001, or equivalent), incident notification commitments, and a tested kill-switch procedure.
• Opaque dependency environments require: documented residual risk acceptance, an exit/migration plan, compensating monitoring (e.g., CSPM/SSPM for what IS visible), and a documented assumption of what the dependency provides. CERG does not pretend to control what it cannot control.

5. Edge Register Operations

5.1 Register Maintenance

The Edge Register is maintained as a living document. The Vendor Risk Analyst (or delegate) reviews each edge type quarterly:

• New edges added within 30 days of discovery
• Edges retired when the relationship, service, or path no longer exists
• Control level re-assessed annually

5.2 Integration with CERG Procedures

5.3 The Principle

A program that knows its edge is less impressed by attack branding.

AI-powered attacks, supply-chain campaigns, and nation-state actors all exploit the same thing: an edge the organization didn’t know it had, or didn’t manage. The edge doesn’t care about the attacker’s tooling. It cares whether the path existed.

6. Document Control

Revision History

Review Triggers

Annual review or upon: material change to vendor population, SaaS portfolio, network architecture, or regulatory scope.

Related Documents

Know your edge. Manage it deliberately. Never be surprised.

CERG-GOV-EDG-001 · Version 1.0 · PUBLIC

Source: governance/CERG-GOV-EDG-001_Edge_Register.md · Download .md · View on GitHub