Compliance and Governance

Trust Service Criteria (TSC)

Security (CC1-CC9) is mandatory. Others optional but often requested.

Optional: Availability (A1), Confidentiality (C1), Processing Integrity (PI1), Privacy (P1-P8).

Control Matrix

Every control needs:

Control ID:         SEC-001
TSC Mapping:        CC6.1, CC6.2
Description:        MFA is required for all privileged access
Type:               Preventive
Owner:              Security Engineering
Frequency:          Continuous
Evidence:           IAM policy config, MFA enforcement logs
Testing Procedure:  Auditor verifies MFA required via identity provider config

Evidence Automation

Pre-Audit Readiness (4-6 Weeks Before)

• All controls documented with owner, frequency, evidence type
• Evidence collected for full observation period (Type II)
• Gaps remediated
• Policies signed within last 12 months
• Access reviews completed per scheduled frequency
• Critical/high vulnerabilities patched per SLA
• Incident response plan tested within last 12 months
• DR/BCP tested and documented
• All vendor assessments current

ISO 27001

ISMS Lifecycle

Plan  → Define scope, risk assessment, security policy, controls
Do    → Implement controls, security awareness training
Check → Internal audit, incident analysis, metrics review
Act   → Corrective actions, management review, continuous improvement

Risk Assessment

1. Asset inventory (systems, data, services)
2. Threat analysis (unauthorized access, malware, outages, human error)
3. Vulnerability assessment (unpatched systems, weak config, training gaps)
4. Risk score = Likelihood (1-5) × Impact (1-5)
5. Risk treatment: Accept | Mitigate | Transfer | Avoid

Statement of Applicability (SoA)

Document which ISO 27002 controls apply and why:

Control A.8.1 Access Control Policy
  Applicable: Yes
  Justification: Required to manage user access to production systems
  Implementation: IAM policies enforced via Okta + AWS IAM

Mark non-applicable controls with clear justification (e.g., "Physical security outsourced to cloud provider").

Certification Stages

• Stage 1 (Documentation): ISMS scope, risk assessment, SoA, policy reviewed
• Stage 2 (Implementation, 6+ months operation required): Controls verified operational, evidence reviewed
• Annual surveillance: Focused review of key controls, corrective actions

GDPR

Legal Bases (Must document for EVERY processing activity)

Data Subject Rights (30-day response, extendable to 90)

Build a process: Intake form → identity verification → 30-day clock → fulfillment.

Records of Processing Activities (RoPA — Art. 30)

For each processing activity document:

• Purpose, legal basis, categories of personal data
• Who has access (internal teams, vendors)
• Retention period
• Security measures

Breach Notification (Art. 33-34)

Log ALL breaches even if not reportable.

DPIA Required When

• Systematic monitoring at scale
• Large-scale processing of special categories (health, biometric)
• Automated decisions with legal/significant effect
• New technology with unclear privacy implications

Gap Analysis Methodology

Four-Step Process

1. Document current controls — inventory all policies, procedures, technical controls
2. Map to requirements — align each control to SOC 2 TSC, ISO 27001 Annex A, GDPR articles
3. Identify gaps — missing, design gaps, operating gaps, partial implementation
4. Prioritize remediation — Critical (<2 weeks), High (<30 days), Medium (<90 days), Low (next cycle)

Gap Types

Continuous Compliance

From Point-in-Time to Ongoing

Implementation

1. Automate evidence: cron exports, IaC snapshots, API integrations
2. Centralize: evidence repository with timestamps (evidence/access/, evidence/change/, etc.)
3. Alert on drift: notify when controls fall out of compliance
4. Review cadence: monthly control owner check-in, quarterly steering review

Vendor Management

Maintain a vendor registry with risk tier, last assessment date, and SOC 2 report status.

Common Anti-Patterns

Verification Checklist

SOC 2:

• Control matrix complete (owner, frequency, evidence for each criterion)
• Evidence automated and centralized
• Access reviews executed per schedule
• Vendor assessments current for all critical/high vendors
• Incident response plan tested within 12 months

ISO 27001:

• Risk assessment complete and dated
• Statement of Applicability reviewed
• ISMS scope documented
• Internal audit completed
• Management review conducted

GDPR:

• RoPA complete for all processing activities
• Legal basis documented for each activity
• Data subject rights process documented and tested
• DPIAs completed for high-risk processing
• Breach response process documented
• Vendor DPAs signed

General:

• Continuous evidence collection automated
• Compliance dashboard visible to security/engineering leadership
• Quarterly compliance review scheduled