SOC 2 utan att börja från noll.

SOC 2 Trust Service Criteria — täckning

CC — Common Criteria (Security) — 100% obligatorisk

• CC6.1-6.8 Logical access, network access, malware — 100% täckt automatiskt (AD, ACL, AV, FW)
• CC7.1-7.2 Vulnerability management + monitoring — 100% täckt (CVE-matching, EPSS, SIEM)
• CC7.3-7.4 Incident response + communication — attestering (process)
• CC8.1 Change management — 100% täckt (GitHub-API: branch-protection, signed commits)
• CC9.1 Risk mitigation — attestering (risk-register-review)

A — Availability

• A1.1 Capacity-monitoring — attestering
• A1.2 Backup + recovery — 100% täckt (backup-validering, ej bara existens)
• A1.3 Recovery testing — attestering (DR-testrapport krävs)

C — Confidentiality

• C1.1 Confidentiality policy — attestering
• C1.2 Säker disposal av media — attestering (chain-of-custody)

PI — Processing Integrity

• PI1.1/4/5 Input/output/storage integrity — applikations-specifik, attestering

Sammantaget: 11 av 20 TSC-kontroller (55%) automatiseras. Övriga 9 hanteras via attesteringar i vår Compliance-modul. Tillsammans = 100% täckning av TSC inför auditor.