SOC 2 Technical Readiness Audit

soc2-readiness · v1.0.0 · paid

Code-level first pass against the SOC 2 Trust Services Criteria — logical access, change management, monitoring, incident recovery, and data lifecycle controls an auditor will actually test, checked from your repo before you pay for the real audit.

Logical Access (CC6.1-6.3)

logical-access · weight 0.2 · taxon access-control

Every API Route Checks Permissions
ab-002249
critical
No hardcoded secrets in source code
ab-001258
critical
Production secrets are platform-managed and the repo documents where they live
ab-002626
high
Logout invalidates the server-side session
ab-002233
high
Disabling a user or downgrading their role terminates their live sessions, not just future logins
ab-002627
high
A periodic access-review procedure is documented in the repo
ab-002628
info

Boundaries & Supply Chain (CC6.6-6.8)

boundary-and-supply-chain · weight 0.15 · taxon supply-chain

HSTS header is present with reasonable max-age
ab-000002
high
Infrastructure-as-code does not declare data stores with public network exposure
ab-002629
critical
Lock file is committed and current
ab-000951
high
Third-party CI actions are pinned to full commit SHAs, not mutable tags
ab-002630
high
Direct dependencies are on current major versions
ab-000959
low
A SECURITY.md vulnerability-disclosure policy with a real reporting contact is committed to the repo
ab-002631
low

Change Management (CC8.1)

change-management · weight 0.2 · taxon change-management

CI/CD pipeline runs automated tests and blocks deployment on failures
ab-000971
critical
Staging environment exists with infrastructure and dependencies matching production
ab-000974
high
Database migrations tested on staging or test database before production
ab-000975
high
Code changes flow through a reviewed pull request workflow with committed evidence
ab-002632
high
The deployment path is defined by configuration committed to the repo
ab-002633
low

Vulnerability Management & Monitoring (CC7.1-7.2)

vuln-management-and-monitoring · weight 0.15 · taxon observability

Sensitive operations are recorded in an audit log
ab-002294
critical
An error-tracking SDK is installed and actually initialized in code, with server-side coverage
ab-002634
high
An automated secret-scanning gate exists in the CI or pre-commit change path
ab-002635
medium
Dependency vulnerability scanning enabled
ab-002394
low
No debug logging in production
ab-002307
low

Incident Readiness & Recovery (CC7.4-7.5, A1)

incident-and-recovery · weight 0.15 · taxon operational-readiness

Production monitoring or alerting is configured with repo-visible evidence
ab-002636
high
Health check endpoint exists
ab-002297
medium
Incident response runbook documented with severity levels, communication plan, on-call rotation
ab-000981
medium
Backup and restore posture for persistent data is evidenced in the repo
ab-002637
medium

Data Lifecycle & Confidentiality (C1)

data-lifecycle · weight 0.15 · taxon privacy-consent

Users can delete their account and PII is actually purged
ab-002617
critical
Server-side code does not log full user objects, bodies, or credentials
ab-002620
high
Committed seeds and fixtures contain no real-looking PII
ab-002638
medium
User data has a bounded retention period enforced by a purge mechanism or a committed retention schedule
ab-002639
medium
Log retention is bounded by rotation config, IaC retention settings, or platform-managed logging
ab-002640
low