HLDModulesGovernanceBuilt-in Groups
v1.2 is unreleased — see v1.1 for the current stable release.
SOC 2 Compliance
SOC 2 Trust Service Criteria, cloud enforcement, and control coverage mapping.
SOC 2 Compliance
SOC 2 (System and Organization Controls Type II) is a security and compliance framework developed by the AICPA that evaluates how organisations protect customer data over time. It is widely used by SaaS, cloud-native, and service organisations to demonstrate trust to customers.
SOC 2 evaluates operational effectiveness of controls over an audit period (typically 3–12 months) — not just their design.
Trust Service Criteria (TSC)
A. Security (Mandatory)
- Logical and physical access controls.
- System monitoring and logging.
- Risk mitigation and vulnerability management.
B. Availability
- System uptime and resilience.
- Backup and disaster recovery.
C. Processing Integrity
- Data accuracy, completeness, and validity.
- Change management.
D. Confidentiality
- Data classification.
- Encryption and access restrictions.
E. Privacy (Optional)
- Personal data handling.
- Retention and disposal.
SOC 2 Type II evaluates design + operating effectiveness over a period of 3–12 months. Point-in-time checks alone are insufficient.
What SOC 2 Requires in Cloud Environments
- Strong IAM and access governance.
- Encryption for all data at rest and in transit.
- Continuous logging and monitoring.
- Vulnerability and malware detection.
- Secure configuration baselines (CIS-style guardrails).
- Change management evidence.
- Incident response readiness.
Full Controls Coverage
| SOC 2 Control / Requirement | Tool Coverage | Notes |
|---|---|---|
| IAM least privilege | Cloud Custodian | Policy hygiene and role enforcement |
| MFA enforcement | Cloud Custodian | IAM credential controls |
| Access review automation | Cloud Custodian | Detect unused / over-privileged access |
| Encryption at rest | Cloud Custodian | S3, EBS, RDS encryption checks |
| Encryption in transit | Cloud Custodian | TLS / HTTPS enforcement |
| Public cloud resource exposure | Cloud Custodian | Prevents accidental data exposure |
| Secure cloud configuration baselines | Cloud Custodian | CIS-style guardrails |
| Cloud audit logging enabled | Cloud Custodian | CloudTrail / Activity logs |
| Log collection (OS & application) | Wazuh | Centralised host-level logs |
| Log integrity monitoring | Wazuh | Detects tampering |
| File integrity monitoring (FIM) | Wazuh | Required for Security TSC |
| Malware detection | Wazuh | Host-based threat detection |
| Intrusion detection | Wazuh | Runtime security monitoring |
| Vulnerability scanning | Wazuh | CVE detection on hosts |
| Configuration drift detection (OS) | Wazuh | Detects unauthorised changes |
| Incident detection & alerting | Wazuh | Security event alerts |
| Incident investigation evidence | Wazuh | Timelines and artefacts |
| Backup enforcement | Cloud Custodian | Snapshot / backup policies |
| DR readiness validation | ❌ | Requires architecture & testing |
| Change management approval | ❌ | Process + ticketing |
| Secure SDLC controls | ❌ | CI/CD & governance process |
| Vendor risk management | ❌ | GRC process |
| Security policies & procedures | ❌ | Documentation requirement |
| Employee security training | ❌ | HR & governance |
| Privacy notice & consent (if in scope) | ❌ | Legal & application-level |