SOC 2 without starting from scratch.

SOC 2 Trust Service Criteria — coverage

CC — Common Criteria (Security) — 100% mandatory

• CC6.1-6.8 Logical access, network access, malware — 100% covered automatically (AD, ACL, AV, FW)
• CC7.1-7.2 Vulnerability management + monitoring — 100% covered (CVE matching, EPSS, SIEM)
• CC7.3-7.4 Incident response + communication — attestation (process)
• CC8.1 Change management — 100% covered (GitHub API: branch protection, signed commits)
• CC9.1 Risk mitigation — attestation (risk register review)

A — Availability

• A1.1 Capacity monitoring — attestation
• A1.2 Backup + recovery — 100% covered (backup validation, not just existence)
• A1.3 Recovery testing — attestation (DR test report required)

C — Confidentiality

• C1.1 Confidentiality policy — attestation
• C1.2 Secure media disposal — attestation (chain of custody)

PI — Processing Integrity

• PI1.1/4/5 Input/output/storage integrity — application-specific, attestation

In total: 11 of 20 TSC controls (55%) are automated. The remaining 9 are handled via attestations in our Compliance module. Together = 100% TSC coverage for the auditor.