SOC 2 without starting from scratch.

SOC 2 Trust Service Criteria — coverage

CC — Common Criteria (Security) — 100% mandatory

• CC6.1-6.8 Logical/network access — via GitHub access control, plus AD/ACL/AV/FW where the internal sensor is deployed
• CC7.1-7.2 Vulnerability management + monitoring — technical controls (CVE matching, KEV, SIEM)
• CC7.3-7.4 Incident response + communication — attestation (process)
• CC8.1 Change management — covered via GitHub API (branch protection, signed commits)
• CC9.1 Risk mitigation — attestation (risk register review)

A — Availability

• A1.1 Capacity monitoring — attestation
• A1.2 Backup + recovery — we help you document tested restores (not just that a backup exists)
• A1.3 Recovery testing — attestation (DR test report required)

C — Confidentiality

• C1.1 Confidentiality policy — attestation
• C1.2 Secure media disposal — attestation (chain of custody)

PI — Processing Integrity

• PI1.1/4/5 Input/output/storage integrity — application-specific, attestation

We automate the technically testable TSC controls; the rest are handled via attestations in our Compliance module for the auditor.