SOC Compliance

CapSign infrastructure is designed to support SOC 1, SOC 2, and SOC 3 certification requirements. This guide outlines how our infrastructure components align with SOC controls and what additional steps are needed for certification.

📋 SOC Certification Overview

SOC 1 (Financial Reporting Controls)

• Purpose: Controls over financial reporting systems

• Audience: Service organizations' management, user entities, and their auditors

• Focus: Financial controls, cost tracking, billing accuracy

SOC 2 (Trust Services Criteria)

• Purpose: Controls relevant to security, availability, processing integrity, confidentiality, and privacy

• Audience: Management, clients, and other specified parties

• Focus: Operational security and privacy controls

SOC 3 (General Use Report)

• Purpose: General use report suitable for broad distribution

• Audience: Anyone (public report)

• Focus: High-level summary of SOC 2 controls

🏗️ CapSign Infrastructure SOC Alignment

🔒 Security Controls (SOC 2)

Access Controls

Component	SOC Control	Implementation
AWS IAM	CC6.1, CC6.2	Role-based access control, MFA enforcement
GitHub	CC6.1, CC6.3	Branch protection, required reviews, RBAC
EKS RBAC	CC6.1, CC6.2	Kubernetes role-based access control
Terraform State	CC6.1, CC6.7	S3 bucket encryption, DynamoDB locking

Monitoring & Logging

Component	SOC Control	Implementation
AWS CloudTrail	CC7.1, CC7.2	Complete API audit trail
EKS Logging	CC7.1, CC7.2	Control plane and audit logs
Prometheus	CC7.1, CC7.4	Real-time monitoring and alerting
GitHub Actions	CC7.1, CC7.2	CI/CD pipeline audit logs

Network Security

Component	SOC Control	Implementation
VPC	CC6.6, CC6.7	Network isolation and segmentation
Security Groups	CC6.6, CC6.1	Firewall rules and access controls
Network Policies	CC6.6, CC6.7	Pod-to-pod communication controls

💰 Financial Controls (SOC 1)

Cost Management

Component	SOC Control	Implementation
Infracost	F1.1, F1.2	Automated cost estimation and tracking
AWS Cost Explorer	F1.3, F1.4	Cost monitoring and reporting
Terraform State	F1.1, F1.5	Infrastructure change tracking

Change Management

Component	SOC Control	Implementation
GitHub Actions	F2.1, F2.2	Automated deployment controls
Terraform	F2.1, F2.3	Infrastructure as code versioning
Helm	F2.1, F2.2	Application deployment controls

🔐 Privacy & Confidentiality (SOC 2)

Data Protection

Component	SOC Control	Implementation
S3 Encryption	CC6.7, P1.1	Data at rest encryption
EKS Encryption	CC6.7, P1.1	Secrets and etcd encryption
TLS	CC6.7, P1.1	Data in transit encryption

Secrets Management

Component	SOC Control	Implementation
GitHub Secrets	CC6.7, P1.1	Encrypted secrets storage
AWS Secrets Manager	CC6.7, P1.1	Dynamic secrets rotation
Kubernetes Secrets	CC6.7, P1.1	Application secrets management

🏆 SOC-Compliant Third-Party Services

✅ SOC 2 Type II Certified Vendors

Service	Certification	Usage	SOC Benefit
AWS	SOC 1/2/3	Infrastructure platform	Complete infrastructure controls
GitHub	SOC 2 Type II	Source code management	Development lifecycle controls
Infracost	SOC 2 Type II	Cost management	Financial reporting controls
FOSSA	SOC 2 Type II	License compliance	Risk management controls
Slack	SOC 2 Type II	Team communication	Operational controls

📊 Vendor Risk Assessment

All third-party services undergo vendor risk assessment:

1. SOC 2 certification verification

2. Security questionnaire completion

3. Contract review for SOC compliance clauses

4. Regular certification status monitoring

🔍 Audit Evidence Collection

Automated Evidence Collection

Our infrastructure automatically collects SOC audit evidence:

Security Controls Evidence

# Security scan results
- Checkov security findings
- FOSSA vulnerability reports
- GitHub security alerts
- AWS Security Hub findings

# Access control evidence
- IAM policy changes
- GitHub permission changes
- Kubernetes RBAC modifications
- Failed authentication attempts

Operational Controls Evidence

# Change management evidence
- Terraform plan/apply logs
- GitHub Actions workflow logs
- Helm deployment history
- Infrastructure change approvals

# Monitoring evidence
- Prometheus metrics history
- AWS CloudWatch logs
- Application performance data
- Incident response records

Financial Controls Evidence

# Cost management evidence
- Infracost estimation reports
- AWS cost allocation reports
- Budget variance analysis
- Resource utilization metrics

📋 SOC Compliance Checklist

Pre-Certification Preparation

Technical Controls

• Deploy all infrastructure using provided Terraform

• Enable all monitoring (Prometheus, Grafana, AlertManager)

• Configure audit logging (CloudTrail, EKS audit logs)

• Implement backup procedures for critical data

• Set up incident response workflows and communication

Administrative Controls

• Develop security policies and procedures

• Create access control matrix and approval workflows

• Document change management processes

• Establish vendor management program

• Create business continuity and disaster recovery plans

Third-Party Services

• Enable Infracost for cost controls (SOC 1 requirement)

• Enable FOSSA for security controls (SOC 2 requirement)

• Configure Slack for operational controls

• Verify vendor SOC certificates are current

• Review vendor contracts for SOC compliance clauses

Ongoing Compliance

Monthly Tasks

• Review access permissions and remove unnecessary access

• Analyze security scan results and remediate findings

• Review cost variance reports and investigate anomalies

• Update vendor risk assessments if changes occur

• Test backup and recovery procedures

Quarterly Tasks

• Conduct access control review with business owners

• Perform vulnerability assessments and penetration testing

• Review and update policies based on business changes

• Assess third-party vendor SOC certification status

• Test incident response procedures

Annual Tasks

• Conduct SOC readiness assessment with external auditor

• Review and update business continuity plans

• Perform annual security training for all personnel

• Review and renew vendor contracts and certifications

• Update risk assessments based on infrastructure changes

🎯 Implementation Timeline

Phase 1: Foundation (Weeks 1-4)

• Deploy core infrastructure (AWS, EKS, monitoring)

• Enable basic security controls (Checkov, AWS security)

• Set up audit logging and evidence collection

Phase 2: Enhanced Controls (Weeks 5-8)

• Enable SOC-compliant third-party services (Infracost, FOSSA)

• Implement advanced monitoring and alerting

• Develop security policies and procedures

Phase 3: Pre-Audit (Weeks 9-12)

• Conduct internal SOC readiness assessment

• Remediate any identified control gaps

• Prepare audit evidence packages

Phase 4: SOC Audit (Weeks 13-16)

• Engage with SOC auditor

• Provide evidence and demonstrate controls

• Address any auditor findings

🚨 Common SOC Pitfalls to Avoid

Technical Pitfalls

• ❌ Incomplete logging - Ensure all systems generate audit logs

• ❌ Weak access controls - Implement least privilege access

• ❌ Manual processes - Automate controls where possible

• ❌ Unencrypted data - Encrypt data at rest and in transit

Administrative Pitfalls

• ❌ Undocumented procedures - Document all critical processes

• ❌ Inconsistent enforcement - Apply controls consistently

• ❌ Inadequate training - Train personnel on SOC requirements

• ❌ Poor vendor management - Monitor vendor compliance status

📞 SOC Certification Support

Internal Team Roles

• SOC Program Manager - Overall program coordination

• Infrastructure Team - Technical control implementation

• Security Team - Security control monitoring

• Compliance Team - Policy development and audit coordination

External Support

• SOC Auditor - Independent assessment of controls

• Legal Counsel - Contract and regulatory guidance

• Security Consultants - Specialized technical expertise

🔗 Additional Resources

SOC Standards

• AICPA SOC 2 Implementation Guide

• Trust Services Criteria

• SOC for Service Organizations

Compliance Frameworks

• NIST Cybersecurity Framework

• ISO 27001

• CIS Controls

---

🎯 Result: Following this guide will position CapSign for successful SOC 1, SOC 2, and SOC 3 certification with a robust, auditable infrastructure platform.