SOC2 CC4 - Security Monitoring Review Procedures

Control: CC4 - Monitoring Activities Status: Procedure template Last Updated: 2025-12-16 Owner: Infrastructure Administrator

---

Overview

This document defines the governance procedures for reviewing security monitoring data generated by CloudForge CI infrastructure. These procedures complement the automated technical monitoring and are a template for addressing SOC2 CC4 (Monitoring Activities) requirements.

---

Automated Monitoring Infrastructure

CloudForge CI deploys the following monitoring components automatically:

Component	Purpose	SOC2 Control
AWS CloudTrail	API audit logging	CC7.2, CC4.1
AWS GuardDuty	Threat detection	CC7.2, CC4.2
AWS Config	Configuration compliance	CC4.1, CC8.1
VPC Flow Logs	Network traffic monitoring	CC6.6, CC7.2
CloudWatch Alarms	Resource and security alerts	CC4.2, CC7.2
Security Hub	Centralized security findings	CC4.1, CC7.2

---

Review Schedules

Daily Reviews (Automated + Manual)

Review Item	Responsible	Action
GuardDuty High/Critical Findings	Infrastructure Administrator	Investigate within 4 hours
CloudWatch Alarm Triggers	Infrastructure Administrator	Respond per runbook
Failed Authentication Attempts	Infrastructure Administrator	Review patterns, block if needed

Automation: GuardDuty findings with severity HIGH or CRITICAL trigger SNS notifications.

Weekly Reviews

Review Item	Responsible	Meeting
GuardDuty Finding Summary	Infrastructure Administrator	Weekly Review
AWS Config Non-Compliant Resources	Infrastructure Administrator	Weekly Review
CloudTrail Unusual Activity	Infrastructure Administrator	Weekly Review
Access Key Age Report	Infrastructure Administrator	Weekly Review

Evidence Location: Meeting notes stored in [INTERNAL]/security-reviews/weekly/

Monthly Reviews

Review Item	Responsible	Deliverable
Security Hub Score Trend	Infrastructure Administrator	Monthly Security Report
Control Effectiveness Assessment	Infrastructure Administrator	Control Assessment Document
User Access Review	Infrastructure Administrator	Access Review Certification
Vulnerability Scan Results	Infrastructure Administrator	Vulnerability Report

Evidence Location: Monthly reports stored in [INTERNAL]/compliance/monthly-reports/

Quarterly Reviews

Review Item	Responsible	Deliverable
SOC2 Control Assessment	Infrastructure Administrator	Quarterly Control Review
Penetration Test Review	Infrastructure Administrator	Pen Test Remediation Plan
Security Architecture Review	Infrastructure Administrator	Architecture Assessment
Third-Party Risk Review	Infrastructure Administrator	Vendor Risk Assessment

---

Escalation Procedures

Severity Levels

Severity	Response Time	Action
Critical	15 minutes	Immediate response, notify stakeholders
High	4 hours	Investigate and remediate
Medium	24 hours	Review and address
Low	7 days	Batch review

GuardDuty Finding Response

Critical/High Finding Detected
         ↓
    SNS Notification
         ↓
    Acknowledge Alert (15 min)
         ↓
    Initial Triage & Containment
         ↓
    Create Incident Ticket
         ↓
    Investigation & Remediation
         ↓
    Post-Incident Review
         ↓
    Update Runbooks if needed

---

Control Effectiveness Reporting

Monthly Metrics Dashboard

The following metrics are tracked monthly to assess control effectiveness:

Metric	Target	Measurement
Mean Time to Detect (MTTD)	< 1 hour	GuardDuty detection time
Mean Time to Respond (MTTR)	< 4 hours	Ticket creation to resolution
False Positive Rate	< 20%	GuardDuty findings marked benign
Config Compliance Score	> 95%	AWS Config compliant resources
Security Hub Score	> 80%	Security Hub security score
Unreviewed Findings	0	Findings pending > 7 days

Quarterly Control Assessment

Each quarter, assess:

1. Completeness: Are all monitoring systems operational?
2. Timeliness: Are reviews happening on schedule?
3. Effectiveness: Are controls detecting real issues?
4. Coverage: Are all in-scope systems monitored?

Template: docs/compliance/templates/quarterly-control-assessment.md

---

Evidence Collection

Automated Evidence

CloudForge CI automatically generates evidence:

• CloudTrail Logs: S3 bucket with 6-year retention
• Config Snapshots: Configuration history in AWS Config
• GuardDuty Findings: Exportable via Security Hub
• CloudWatch Metrics: 15-month retention (configurable)

Manual Evidence

Evidence Type	Location	Retention
Weekly meeting notes	SharePoint/Confluence	3 years
Monthly security reports	SharePoint/Confluence	7 years
Incident tickets	Jira/ServiceNow	7 years
Access review certifications	SharePoint/Confluence	7 years

---

Audit Support

When auditors request CC4 evidence, provide:

1. Technical Controls: AWS Config conformance pack results
2. Review Evidence: Meeting notes, monthly reports
3. Metrics: Control effectiveness dashboard export
4. Incident History: Sanitized incident tickets

---

Appendix: CloudForge CI Monitoring Configuration

GuardDuty Setup (GuardDutyFactory)

// Created when guardDutyEnabled and createGuardDutyDetector are true (simplified)
CfnDetector.Builder.create(this, "GuardDutyDetector")
    .enable(true)
    .findingPublishingFrequency("FIFTEEN_MINUTES")  // CC4.2: Timely detection
    .build();

CloudTrail Setup (ComplianceFactory)

// Audit logging (simplified)
Trail.Builder.create(this, "CloudTrail")
    .sendToCloudWatchLogs(true)
    .cloudWatchLogsRetention(config.getLogRetentionDays())  // CC4.1: Log retention
    .enableFileValidation(true)  // CC4.1: Log integrity
    .isMultiRegionTrail(true)    // CC4.1: Complete coverage
    .build();

AWS Config Setup (ComplianceFactory)

// Continuous compliance monitoring
CfnConfigurationRecorder.Builder.create(this, "ConfigRecorder")
    .recordingGroup(/* all resource types */)  // CC4.1: Configuration monitoring
    .build();

---

Document Control

Version	Date	Author	Changes
1.0	2025-12-16	CloudForge CI	Initial release