SOC 2 Controls Gap Analysis & Coverage Report

Document Status: Living Document Last Updated: 2025-12-19 Version: 1.2 Owner: Security & Compliance Team Review Cycle: Quarterly

Document Purpose

This document analyzes CloudForge CI's SOC 2 Trust Services Criteria (TSC) implementation, identifying:

✅ Controls that are fully automated via infrastructure
⚠️ Controls that are partially automated
❌ Controls that require manual implementation
Infrastructure verification and evidence locations
Gap remediation roadmap

Audience: Security teams, compliance officers, auditors, and engineering leadership

Scope note: This analysis maps infrastructure controls to SOC 2 criteria. It distinguishes three things: controls CloudForge configures, validation that checks those controls at synthesis time (Soc2Rules, enabled with auditManagerEnabled and complianceFrameworks: soc2), and SOC 2 attestation, which only an independent CPA firm can provide. Procedure documents referenced here are templates that an organization must adopt, operate, and evidence itself.

Executive Summary
SOC 2 Framework Overview
Implementation Architecture
Detailed Control Mapping
Infrastructure Verification
Gap Analysis
Coverage Metrics
Remediation Roadmap
Testing Status
Maintenance & Updates

Executive Summary

Overall Coverage

CloudForge CI implements SOC 2 Trust Services Criteria controls at the infrastructure level with a multi-layered enforcement approach:

Metric	Value	Status
Total TSC Criteria	~64 criteria (2017 AICPA Framework)	-
Automated Controls	17 criteria (~27%)	✅ Infrastructure
Partially Automated	0 criteria (0%)	-
Manual Controls Required	47 criteria (~73%)	❌ Organizational
Infrastructure Coverage	Estimated ~70-80% of automatable technical controls	✅ Infrastructure
Production Tested	Infrastructure controls only	⚠️ Auth not tested

Procedure templates are provided for CC4, CC5, C1.2, and PI1.4:

SOC2_CC4_MONITORING_PROCEDURES.md - Security monitoring review procedures
SOC2_CC5_OPERATIONAL_PROCEDURES.md - Control activities and operational procedures
SOC2_C1.2_DATA_DISPOSAL_PROCEDURES.md - Information disposal procedures
SOC2_PI1.4_ERROR_DETECTION.md - Error detection and correction guidance

Infrastructure Controls

✅ Security (CC) technical controls: encryption, network segmentation, logging, and monitoring configured by the security profile
✅ Layered checks: validation rules, cfn-guard policies, AWS Config, and security profiles
✅ Evidence sources: CloudTrail, AWS Config, and Audit Manager integration
✅ Availability (A): Multi-AZ, auto-scaling, automated backups
✅ Confidentiality (C): Encryption at rest and in transit, key management

Critical Gaps

⚠️ Organizational Controls: CC1, CC2, CC3 procedure templates provided (see SOC2_CC1_CONTROL_ENVIRONMENT.md, SOC2_CC2_COMMUNICATION.md, SOC2_CC3_RISK_ASSESSMENT.md); the organization must operate them
⚠️ Incident Response: CC7.4/7.5 procedure template provided (see SOC2_CC7_INCIDENT_RESPONSE.md)
❌ Processing Integrity (PI): Application-level validation required (PI1.1-PI1.3)
⚠️ Privacy (P): Policy template provided (see SOC2_PRIVACY_PROCEDURES.md)
⚠️ Authentication: Cognito/OIDC implemented but not production-tested

SOC 2 Framework Overview

Trust Services Categories (2017 AICPA)

The SOC 2 framework consists of 5 Trust Services Categories with 64 criteria across ~300 points of focus:

Common Criteria (CC) - Security (Mandatory) - CC1.0 through CC9.0
Availability (A) (Optional) - A1.1 through A1.3
Processing Integrity (PI) (Optional) - PI1.1 through PI1.4
Confidentiality (C) (Optional) - C1.1 through C1.2
Privacy (P) (Optional) - P1.0 through P8.0

Note: Security (Common Criteria) is mandatory for all SOC 2 reports. Additional categories are selected based on the nature of services provided.

Implementation Architecture

CloudForge CI implements SOC 2 controls through 4 enforcement layers:

Layer 1: Validation Rules (Pre-Synthesis)

File: cloudforge-api/src/main/java/com/cloudforgeci/api/core/rules/Soc2Rules.java

Java-based validation executed during CDK synthesis
Validates security profile configuration against SOC 2 requirements
Blocks deployment if mandatory controls are missing (ENFORCE mode)
Provides warnings for recommended controls (ADVISORY mode)

Controls Validated:

CC6.1/CC6.2: Access controls, authentication, encryption
CC6.6/CC6.7: Network security, data transmission
CC7.2: System monitoring (CloudTrail, GuardDuty, Config, Flow Logs)
CC8.1: Change management
A1.2: High availability (Multi-AZ, auto-scaling)
A1.3: Backup and recovery
C1.1/C1.2: Confidentiality (encryption, access restrictions)

Layer 2: CloudFormation Guard Policies (Pre-Deployment)

File: cloudforge-api/src/main/resources/cfn-guard/frameworks/soc2-trust-services.guard

Policy-as-Code validation of CloudFormation templates
Enforces security controls before infrastructure creation
15 validation rules covering encryption, access control, monitoring, backups

Key Rules:

soc2_s3_block_public: S3 public access prevention (CC6.1)
soc2_s3_encryption: S3 bucket encryption (C1.1)
soc2_rds_encryption: RDS storage encryption (C1.1)
soc2_cloudtrail_enabled: CloudTrail logging (CC7.2)
soc2_cloudwatch_log_retention: 365+ day retention (CC7.2)
soc2_dynamodb_pitr: Point-in-time recovery (A1.3)

Layer 3: AWS Config Rules (Runtime Monitoring)

File: cloudforge-api/src/main/java/com/cloudforgeci/api/observability/ComplianceFactory.java

Continuous compliance monitoring via AWS Config
16 AWS Config managed rules for SOC 2
Automatic remediation via SSM Automation Documents
Evidence collection for Audit Manager

Rule Categories:

Base Controls (9 rules): Always deployed regardless of framework
SOC2-Specific Controls (7 rules): Conditional on complianceFrameworks: "SOC2"

Layer 4: Security Profile Configuration (Infrastructure Defaults)

File: cloudforge-api/src/main/java/com/cloudforgeci/api/core/security/ProductionSecurityProfileConfiguration.java

Production-grade security defaults
Enforces encryption, monitoring, backups, high availability
2-year log retention, Multi-AZ enforcement, MFA required

Detailed Control Mapping

Common Criteria (CC) - Security (Mandatory)

CC6.1 - Logical and Physical Access Controls

Sub-Control	Requirement	Implementation	Status	Evidence
CC6.1.1	Restrict logical access	IAM policies, security groups, NACLs	✅ Automated	`Soc2Rules.java`
CC6.1.2	Identify and authenticate users	IAM password policy, MFA	✅ Automated	AWS Config: `iam-password-policy`, `iam-user-mfa-enabled`
CC6.1.3	Remove access when no longer required	Access key rotation (90 days)	✅ Automated	AWS Config: `access-keys-rotated`
CC6.1.4	Restrict access to data	S3 bucket policies, encryption	✅ Automated	AWS Config: `s3-bucket-public-read-prohibited`

Infrastructure Implementation:

// Soc2Rules.java - IAM access controls validation
if (ctx.iamProfile == null) {
    rules.add(ComplianceRule.fail(
        "SOC2-CC6.1-IAM",
        "IAM access controls required",
        "IAMPasswordPolicyRule",
        "Implement role-based access control (RBAC)..."
    ));
}

Config Rules Deployed:

iam-password-policy - Enforces 12+ char password, complexity
iam-root-access-key-rule - No root access keys
iam-user-no-policies - Users must use groups
access-keys-rotated - 90-day key rotation

CC6.2 - Access Management

Sub-Control	Requirement	Implementation	Status	Evidence
CC6.2.1	User authentication	OIDC, Cognito, MFA	⚠️ Implemented, not tested	`Soc2Rules.java`
CC6.2.2	MFA for privileged access	IAM MFA, Cognito MFA	⚠️ Implemented, not tested	`ProductionSecurityProfileConfiguration.java`

Infrastructure Implementation:

// Soc2Rules.java - Authentication validation
AuthMode authMode = ctx.cfc.authMode();
if (authMode == AuthMode.NONE) {
    rules.add(ComplianceRule.fail(
        "SOC2-CC6.2-Auth",
        "User authentication required for customer-facing systems",
        "Configure authMode = 'alb-oidc', 'jenkins-oidc', or 'application-oidc'..."
    ));
}

Authentication Options (authMode):

alb-oidc: ALB-integrated OIDC (Amazon Cognito, AWS IAM Identity Center, or another OIDC provider)
application-oidc: Application-level OIDC, for applications that support it natively

Cognito user pools with MFA are provisioned with cognitoAutoProvision and cognitoMfaEnabled. SAML federation is an incomplete feature and is not selectable through authMode.

The validator's remediation message still lists jenkins-oidc, which is not an authMode value.

Action Required: Test Cognito and OIDC integrations in production environment

CC6.6 - Network Segmentation

Sub-Control	Requirement	Implementation	Status	Evidence
CC6.6.1	Network segmentation	VPC, private subnets, security groups	✅ Automated	`Soc2Rules.java`
CC6.6.2	Firewall protection	WAF, security groups	✅ Automated	`Soc2Rules.java`

Infrastructure Implementation:

VPC with public/private subnet isolation
Security groups with least-privilege rules
NACLs for additional network layer protection
AWS WAF for web application firewall (optional, recommended)

Config Rules Deployed:

vpc-default-security-group-closed - Default SG has no rules
restricted-ssh - SSH not open to 0.0.0.0/0
restricted-common-ports - Common ports restricted

CC6.7 - Data Transmission Security

Sub-Control	Requirement	Implementation	Status	Evidence
CC6.7.1	Encryption in transit	TLS 1.2+, HTTPS	✅ Automated	`Soc2Rules.java`
CC6.7.2	Certificate management	ACM, auto-renewal	✅ Automated	`AuditManagerControlRegistry.java`

Infrastructure Implementation:

// Soc2Rules.java - SSL/TLS enforcement
if (!ctx.cfc.enableSsl()) {
    rules.add(ComplianceRule.fail(
        "SOC2-CC6.7-SSL",
        "SSL/TLS must be enabled for encrypted data transmission (CC6.7)",
        "Set enableSsl=true for production SOC2 compliance."
    ));
}

Encryption Controls:

ALB HTTPS listeners with TLS 1.2+ minimum
EFS encryption in transit (TLS)
ACM certificates with automatic renewal
Certificate expiration monitoring

Guard Policy: soc2_alb_https - Validates HTTPS/TLS protocol on port 443

CC7.2 - System Monitoring

Sub-Control	Requirement	Implementation	Status	Evidence
CC7.2.1	Security monitoring	CloudWatch, GuardDuty, Config	✅ Automated	`Soc2Rules.java`
CC7.2.2	Threat detection	GuardDuty	✅ Automated	`Soc2Rules.java`
CC7.2.3	Audit logging	CloudTrail, Flow Logs, ALB logs	✅ Automated	`Soc2Rules.java`
CC7.2.4	Configuration monitoring	AWS Config	✅ Automated	`Soc2Rules.java`

Infrastructure Implementation:

CloudTrail: All API calls logged to S3 (2-year retention)
VPC Flow Logs: Network traffic monitoring (all traffic)
ALB Access Logs: HTTP request logging
GuardDuty: Threat detection with auto-start
AWS Config: Continuous compliance monitoring with 16 rules

Config Rules Deployed:

cloudtrail-enabled - CloudTrail logging active
vpc-flow-logs-enabled - Flow logs enabled
guardduty-enabled-centralized - GuardDuty active

Guard Policies:

soc2_cloudtrail_enabled - CloudTrail IsLogging = true
soc2_cloudwatch_log_retention - 365+ day retention

CC8.1 - Change Management

Sub-Control	Requirement	Implementation	Status	Evidence
CC8.1.1	Change tracking	CloudTrail, Git version control	✅ Automated	`Soc2Rules.java`
CC8.1.2	Configuration change detection	AWS Config	✅ Automated	`Soc2Rules.java`
CC8.1.3	Infrastructure as Code	CDK (CloudFormation)	✅ Automated	`Soc2Rules.java`

Infrastructure Implementation:

Git repository provides version control and audit trail
CloudTrail logs all infrastructure changes
AWS Config tracks configuration drift
CDK provides immutable infrastructure deployments

CC1, CC2, CC3, CC4, CC5, CC9 - Organizational Controls

Control	Description	Status	Remediation
CC1	Control Environment (governance, ethics, integrity)	✅ Documented	See `SOC2_CC1_CONTROL_ENVIRONMENT.md`
CC2	Communication & Information (policies, communication)	✅ Documented	See `SOC2_CC2_COMMUNICATION.md`
CC3	Risk Assessment (risk analysis, change processes)	✅ Documented	See `SOC2_CC3_RISK_ASSESSMENT.md`
CC4	Monitoring Activities (control effectiveness)	✅ Documented	See `SOC2_CC4_MONITORING_PROCEDURES.md`
CC5	Control Activities (operational procedures)	✅ Documented	See `SOC2_CC5_OPERATIONAL_PROCEDURES.md`
CC9	Risk Mitigation (vendor management)	❌ Not Automated	Implement vendor assessment program, third-party SOC 2 reviews

Why Not Automated: These controls require organizational structure, governance processes, human decision-making, and policy documentation that cannot be infrastructure-automated.

Action Required: Document policies, procedures, and governance structures

CC7.1, CC7.3, CC7.4, CC7.5 - Additional System Operations

Control	Description	Status	Evidence
CC7.1	Vulnerability detection and remediation	✅ Automated	AWS Config, Inspector (via `VULNERABILITY_MANAGEMENT` control)
CC7.3	Environmental protections	✅ Automated	Multi-AZ, backups (see A1.2, A1.3)
CC7.4	Incident response	✅ Documented	See `SOC2_CC7_INCIDENT_RESPONSE.md`
CC7.5	Incident resolution	✅ Documented	See `SOC2_CC7_INCIDENT_RESPONSE.md`

CC7.1 Implementation:

AWS Config continuous compliance monitoring
Security Hub (optional) for centralized findings
Inspector (optional) for vulnerability scanning

CC7.4/7.5 Gap: Automated detection exists (GuardDuty, Config), but response procedures require documentation

Availability (A) (Optional Category)

A1.2 - System Availability

Sub-Control	Requirement	Implementation	Status	Evidence
A1.2.1	High availability architecture	Multi-AZ deployment	✅ Automated	`Soc2Rules.java`
A1.2.2	Auto-scaling	Auto-scaling groups	✅ Automated	`Soc2Rules.java`

Infrastructure Implementation:

// ProductionSecurityProfileConfiguration.java
public boolean isMultiAzEnforced() {
    return true; // Always enforced for production
}

public boolean isAutoScalingEnabled() {
    return true; // Always enabled for production
}

public int getMinInstanceCount() {
    return 2; // Minimum for high availability
}

Config Rules Deployed:

elb-deletion-protection-enabled - Prevents accidental ALB deletion
rds-multi-az-support - Enforces Multi-AZ for databases

A1.3 - Recovery Capabilities

Sub-Control	Requirement	Implementation	Status	Evidence
A1.3.1	Automated backups	EBS snapshots, RDS backups	✅ Automated	`Soc2Rules.java`
A1.3.2	Cross-region backup	S3 cross-region replication	✅ Automated	`Soc2Rules.java`
A1.3.3	Backup retention	90-day retention	✅ Automated	`ProductionSecurityProfileConfiguration.java`

Infrastructure Implementation:

Automated backups always enabled for production
90-day retention for backup data
Cross-region backup for disaster recovery
S3 versioning for data recovery

Config Rules Deployed:

s3-bucket-versioning-enabled - S3 versioning for recovery
dynamodb-pitr-enabled - DynamoDB point-in-time recovery

Guard Policies:

soc2_s3_versioning - S3 versioning enabled
soc2_rds_backups - RDS backup retention ≥ 7 days
soc2_dynamodb_pitr - DynamoDB PITR enabled

A1.1 - Availability Commitments

Control	Status	Remediation
A1.1	❌ Not Automated	Document SLA commitments, uptime targets

Confidentiality (C) (Optional Category)

C1.1 - Confidentiality Commitments

Sub-Control	Requirement	Implementation	Status	Evidence
C1.1.1	Encryption at rest	EBS, EFS, S3 encryption (AES-256)	✅ Automated	`Soc2Rules.java`
C1.1.2	Key management	KMS key rotation	✅ Automated	`AuditManagerControlRegistry.java`
C1.1.3	Access restrictions	Private network mode	✅ Automated	`Soc2Rules.java`

Infrastructure Implementation:

All storage encrypted by default (EBS, EFS, S3, RDS)
KMS customer-managed keys with automatic rotation
Private subnet deployment for confidential systems
No public database access

Config Rules Deployed:

encrypted-volumes - EBS encryption
s3-bucket-encryption - S3 encryption
rds-storage-encrypted - RDS encryption
dynamodb-encryption-enabled - DynamoDB encryption
kms-key-rotation-enabled - Annual key rotation

Guard Policies:

soc2_s3_encryption - S3 BucketEncryption exists
soc2_rds_encryption - RDS StorageEncrypted = true
soc2_ebs_encryption - EBS Encrypted = true
soc2_dynamodb_encryption - DynamoDB SSEEnabled = true

C1.2 - Information Disposal

Sub-Control	Requirement	Implementation	Status	Evidence
C1.2.1	Secure data deletion	S3 lifecycle policies + procedures	✅ Documented	`SOC2_C1.2_DATA_DISPOSAL_PROCEDURES.md`

Implementation: S3 lifecycle policies automate data disposal. The procedure template covers manual disposal, key destruction, and verification.

Documentation: See SOC2_C1.2_DATA_DISPOSAL_PROCEDURES.md for complete disposal procedures

Processing Integrity (PI) (Optional Category)

Control	Description	Status	Remediation
PI1.1	Processing objectives	❌ Not Automated	Application-level validation required
PI1.2	Input completeness/accuracy	❌ Not Automated	Application-level input validation
PI1.3	Processing completeness/accuracy	❌ Not Automated	Application-level processing validation
PI1.4	Error detection and correction	✅ Documented	See `SOC2_PI1.4_ERROR_DETECTION.md`

Why Not Automated: PI1.1-PI1.3 depend on application-specific business logic and data validation rules.

PI1.4 Implementation: Infrastructure monitoring (CloudWatch, alarms) + application error handling requirements documented in SOC2_PI1.4_ERROR_DETECTION.md

Privacy (P) (Optional Category)

Control	Description	Status	Remediation
P1.0	Privacy notice and communication	✅ Documented	See `SOC2_PRIVACY_PROCEDURES.md`
P2.0	Choice and consent	✅ Documented	See `SOC2_PRIVACY_PROCEDURES.md`
P3.0	Collection	✅ Documented	See `SOC2_PRIVACY_PROCEDURES.md`
P4.0	Use, retention, and disposal	✅ Documented	See `SOC2_PRIVACY_PROCEDURES.md`
P5.0	Access	✅ Documented	See `SOC2_PRIVACY_PROCEDURES.md`
P6.0	Disclosure to third parties	✅ Documented	See `SOC2_PRIVACY_PROCEDURES.md`
P7.0	Quality	✅ Documented	See `SOC2_PRIVACY_PROCEDURES.md`
P8.0	Monitoring and enforcement	✅ Documented	See `SOC2_PRIVACY_PROCEDURES.md`

Note: Privacy procedures are documented but require organizational implementation and legal review.

Action Required: If Privacy category is claimed, implement the procedures documented and conduct legal review

Infrastructure Verification

AWS Config Rules Deployment

Base Controls (Always Deployed)

Rule Name	AWS Managed Rule	TSC Mapping	Purpose	Remediation
`encrypted-volumes`	`ENCRYPTED_VOLUMES`	CC6.1, C1.1	EBS encryption enforcement	Auto-enable via SSM
`s3-bucket-public-read-prohibited`	`S3_BUCKET_PUBLIC_READ_PROHIBITED`	CC6.1	S3 public read prevention	Manual
`s3-bucket-public-write-prohibited`	`S3_BUCKET_PUBLIC_WRITE_PROHIBITED`	CC6.1	S3 public write prevention	Manual
`iam-password-policy`	`IAM_PASSWORD_POLICY`	CC6.1, CC6.2	Password complexity	Manual
`iam-user-mfa-enabled`	`IAM_USER_MFA_ENABLED`	CC6.2	User MFA enforcement	Manual
`root-account-mfa-enabled`	`ROOT_ACCOUNT_MFA_ENABLED`	CC6.2	Root account MFA	Manual
`access-keys-rotated`	`ACCESS_KEYS_ROTATED`	CC6.1	90-day key rotation	Manual
`cloudtrail-enabled`	`CLOUD_TRAIL_ENABLED`	CC7.2, CC8.1	API audit logging	Auto-enable via SSM
`vpc-flow-logs-enabled`	`VPC_FLOW_LOGS_ENABLED`	CC7.2	Network traffic monitoring	Manual

SOC2-Specific Controls (Conditional)

Rule Name	AWS Managed Rule	TSC Mapping	Purpose	Condition
`s3-bucket-versioning-enabled`	`S3_BUCKET_VERSIONING_ENABLED`	A1.3	Backup and recovery	`soc2Condition`
`s3-bucket-encryption`	`S3_DEFAULT_ENCRYPTION_KMS`	C1.1	S3 encryption	`soc2Condition`
`guardduty-enabled-centralized`	`GUARDDUTY_ENABLED_CENTRALIZED`	CC7.2	Threat detection	`soc2Condition`
`kms-key-rotation-enabled`	`CMK_BACKING_KEY_ROTATION_ENABLED`	C1.1	Key management	`soc2Condition`
`elb-deletion-protection-enabled`	`ELB_DELETION_PROTECTION_ENABLED`	A1.2	High availability	`soc2Condition`
`rds-multi-az-support`	`RDS_MULTI_AZ_SUPPORT`	A1.2	Database HA	`soc2RdsCondition`
`rds-storage-encrypted`	`RDS_STORAGE_ENCRYPTED`	C1.1	Database encryption	`soc2RdsCondition`

Total Rules: 16 (9 base + 7 SOC2-specific)

Deployment Logic: See ComplianceFactory.java

CloudFormation Guard Policies

File: soc2-trust-services.guard

Validation Rules (15 total):

Access Control Rules

soc2_s3_block_public - CC6.1: S3 public access blocks
soc2_rds_no_public - CC6.1: RDS not publicly accessible
soc2_kms_key_rotation - C1.1: KMS key rotation enabled

Encryption at Rest Rules

soc2_s3_encryption - C1.1: S3 BucketEncryption exists
soc2_rds_encryption - C1.1: RDS StorageEncrypted = true
soc2_rds_cluster_encryption - C1.1: RDS Cluster encrypted
soc2_ebs_encryption - C1.1: EBS Encrypted = true
soc2_dynamodb_encryption - C1.1: DynamoDB SSEEnabled = true

Encryption in Transit Rules

soc2_alb_https - CC6.7: ALB HTTPS/TLS protocol

Monitoring Rules

soc2_cloudtrail_enabled - CC7.2: CloudTrail IsLogging = true
soc2_cloudwatch_log_retention - CC7.2: Retention ≥ 365 days

Backup and Recovery Rules

soc2_s3_versioning - A1.3: S3 versioning enabled
soc2_rds_backups - A1.3: RDS backup retention ≥ 7 days
soc2_dynamodb_pitr - A1.3: DynamoDB PITR enabled

Security Profile Enforcement

File: ProductionSecurityProfileConfiguration.java

Production Defaults:

With soc2 selected and complianceMode other than disabled, controls that ComplianceMatrix marks as REQUIRED for SOC2 are enabled regardless of the deployment context value.

Control	Configuration	TSC	Overridable
Log Retention	Profile default 6 years; `Soc2Rules` requires at least 365 days	CC7.2	Yes (via `logRetentionDays`, minimum 365)
Flow Logs	Enabled (all traffic)	CC7.2	No (REQUIRED)
CloudTrail	Enabled	CC7.2, CC8.1	No (REQUIRED)
GuardDuty	Enabled by profile default	CC7.2	Yes (via `guardDutyEnabled`; ADVISORY for SOC2)
AWS Config	Validated by `Soc2Rules`	CC7.2, CC8.1	Via `awsConfigEnabled`
Audit Manager	REQUIRED for SOC2 in `ComplianceMatrix`	All	Assessments and validators are created only when `auditManagerEnabled` is `true`
EBS Encryption	Mandatory	C1.1	No
EFS Encryption (transit)	Mandatory	CC6.7	No (REQUIRED)
EFS Encryption (rest)	Mandatory	C1.1	No
S3 Encryption	Mandatory	C1.1	No
Multi-AZ	Enforced	A1.2	No
Auto-scaling	Enabled	A1.2	No
Automated Backup	Enabled	A1.3	No (REQUIRED)
Cross-region Backup	Enabled	A1.3	No (REQUIRED)
MFA Required	Always	CC6.2	No
Password Length	14 characters (profile); IAM account policy 12 characters for SOC2	CC6.2	No
Password Rotation	90 days	CC6.2	No
Session Timeout	1 day	443	CC6.2

Control Registry & Evidence Mapping

File: AuditManagerControlRegistry.java

20 Infrastructure Controls mapped to SOC 2:

Control ID	Description	TSC Mapping	Config Rules	Evidence Sources
`ENCRYPTION_AT_REST`	EBS, EFS, S3 encryption	CC6.1, C1.1	`EbsEncryptionRule`, `S3BucketEncryptionRule`	config, cloudtrail
`ENCRYPTION_IN_TRANSIT`	TLS/SSL	CC6.7	`ALBHttpsOnly`	config, cloudtrail
`NETWORK_SEGMENTATION`	VPC, security groups	CC6.6	`VpcDefaultSecurityGroupClosed`	config, vpc-flowlogs
`ACCESS_CONTROL`	IAM, least privilege	CC6.1, CC6.2	`IAMPasswordPolicyRule`	config, cloudtrail, iam
`AUTHENTICATION`	SSO, OIDC, MFA	CC6.2	`IAMMfaEnabled`	config, cloudtrail, iam
`AUDIT_LOGGING`	CloudTrail, Flow Logs	CC7.2	`CloudTrailEnabledRule`	cloudtrail, vpc-flowlogs
`LOG_RETENTION`	1-6 year retention	CC7.2	`CloudWatchLogGroupRetention`	cloudtrail, s3
`SECURITY_MONITORING`	GuardDuty, Config	CC7.2	`GuardDutyEnabled`	config, guardduty
`THREAT_DETECTION`	GuardDuty	CC7.2	`GuardDutyEnabled`	guardduty, cloudtrail
`WAF_PROTECTION`	AWS WAF	CC6.6	`WafEnabled`	config, waf
`BACKUP_RECOVERY`	Automated backups	A1.3, CC7.3	`EfsBackupEnabled`	config, backup, s3
`HIGH_AVAILABILITY`	Multi-AZ, auto-scaling	A1.2	`RdsMultiAzEnabled`	config, cloudwatch
`CHANGE_MANAGEMENT`	IaC, change tracking	CC8.1	`CloudTrailEnabledRule`	cloudtrail, config
`VULNERABILITY_MANAGEMENT`	Config compliance	CC7.1	`ConfigEnabled`	config, inspector
`KEY_MANAGEMENT`	KMS rotation	CC6.1, C1.1	`KmsKeyRotationEnabled`	kms, cloudtrail
`CERTIFICATE_MANAGEMENT`	TLS/SSL lifecycle	CC6.7	`CertificateExpirationAlarm`	acm, cloudwatch
`DATABASE_SECURITY`	DB encryption, backup	CC6.1, A1.3	`RdsEncryptionAtRestEnabled`	rds, config
`ADVANCED_MONITORING`	Security Hub, Inspector	CC7.2, CC7.3	`SecurityHubEnabled`	securityhub, inspector
`INCIDENT_RESPONSE`	IR plan, DR	CC7.4, CC7.5, A1.2	`IncidentResponsePlanDocumented`	cloudtrail, cloudwatch
`THREAT_PROTECTION`	Malware, intrusion detection	CC7.2, CC7.3	`GuardDutyEnabled`	guardduty, waf

Gap Analysis

Critical Gaps (Require Manual Implementation)

1. Organizational Controls (CC1, CC2, CC3)

Gap: CC1 (Control Environment), CC2 (Communication), CC3 (Risk Assessment)

Impact: ~30% of Common Criteria

Requirement:

CC1: Organizational structure, ethics policies, board oversight, governance
CC2: Security policy documentation, incident communication procedures
CC3: Formal risk assessments, risk management processes, change management procedures

Remediation:

Priority: HIGH
Timeline: 4-6 weeks

Tasks:
1. Document organizational structure and reporting lines
2. Create code of conduct and ethics policy
3. Document board/leadership security oversight
4. Create security policy manual (access control, encryption, incident response)
5. Implement risk assessment framework (annual + change-driven)
6. Document change management procedures

Evidence Required:

Organizational charts
Code of conduct (signed by employees)
Board meeting minutes discussing security
Security policy manual
Risk assessment reports
Change advisory board (CAB) meeting minutes

2. Incident Response Procedures (CC7.4, CC7.5)

Gap: Documented incident response plan, escalation procedures, playbooks

Impact: ~10% of Common Criteria

Current State: Technical detection exists (GuardDuty, Config), but response procedures not documented

Remediation:

Priority: HIGH
Timeline: 2-3 weeks

Tasks:
1. Create incident response plan (IRP) document
2. Define incident severity levels (P0, P1, P2, P3)
3. Document escalation procedures and on-call rotation
4. Create incident playbooks for common scenarios:
   - GuardDuty findings (cryptocurrency mining, unauthorized access)
   - Config non-compliance (encryption disabled, public S3)
   - Security group changes
   - IAM changes (new users, role escalation)
5. Conduct tabletop exercise to test IRP

Evidence Required:

Incident response plan document
Incident playbooks
Tabletop exercise report
Incident tickets showing IRP execution

3. Vendor Management (CC9)

Gap: Vendor risk assessment, third-party SOC 2 reviews, vendor contracts

Impact: ~10% of Common Criteria

Remediation:

Priority: MEDIUM
Timeline: 4-6 weeks
Owner: Procurement + Security

Tasks:
1. Create vendor inventory (AWS, third-party tools)
2. Document vendor assessment process
3. Collect SOC 2 reports from critical vendors
4. Review vendor contracts for security requirements
5. Establish vendor review cadence (annual)

Evidence Required:

Vendor inventory spreadsheet
Vendor assessment questionnaires
Third-party SOC 2 reports
Vendor contracts with security clauses

4. Privacy Controls (P1-P8) (If Privacy Category Claimed)

Gap: Privacy policy, consent management, DSAR procedures, data retention

Impact: 100% of Privacy category

Remediation:

Priority: HIGH (if Privacy claimed)
Timeline: 6-8 weeks
Owner: Legal + Compliance

Tasks:
1. Create privacy policy and privacy notice
2. Implement consent management system
3. Document data collection and usage practices
4. Create data retention and disposal policy
5. Implement DSAR (data subject access request) procedures
6. Document third-party data sharing
7. Create privacy incident response procedures

Evidence Required:

Privacy policy (published on website)
Consent records
Data inventory and processing records
DSAR procedures and response logs
Data retention policy

Partial Gaps (Enhance Existing Controls)

1. C1.2 - Information Disposal

Current State: S3 lifecycle policies exist for log retention

Gap: Comprehensive secure deletion procedures not documented

Remediation:

Priority: MEDIUM
Timeline: 1-2 weeks
Owner: Engineering + Security

Tasks:
1. Document secure deletion procedures for each data type
2. Implement S3 Intelligent-Tiering with automatic deletion
3. Create object lifecycle policies for all S3 buckets
4. Document EBS/EFS deletion procedures
5. Add data disposal to offboarding checklist

Evidence Required:

S3 lifecycle policies for all buckets
Data disposal procedures document
Deletion logs (CloudTrail)

2. PI1.4 - Error Detection and Correction

Current State: Infrastructure monitoring (CloudWatch, Config) exists

Gap: Application-level error detection and data validation

Remediation:

Priority: LOW (unless Processing Integrity claimed)
Timeline: Ongoing (application-specific)
Owner: Application Teams

Tasks:
1. Implement application error logging
2. Add data validation for input/output
3. Create error handling procedures
4. Monitor application error rates

3. Authentication Testing (CC6.2)

Current State: Cognito and OIDC implemented but not production-tested

Gap: Production validation of authentication controls

Remediation:

Priority: HIGH
Timeline: 1-2 weeks
Owner: Engineering

Tasks:
1. Test Cognito authentication in production environment
2. Validate MFA enforcement (TOTP + SMS)
3. Test OIDC integrations (Identity Center, Google, Okta)
4. Verify session management and timeout
5. Test password policy enforcement
6. Document authentication flows

Testing Checklist:

Coverage Metrics

Overall TSC Coverage

Category	Total Criteria	Automated	Manual	Coverage %
Common Criteria (CC)	~45	10	35	~22%
Availability (A)	~5	3	2	60%
Confidentiality (C)	~3	3	0	100%
Processing Integrity (PI)	~4	1	3	~25%
Privacy (P)	~7	0	7	0%
TOTAL	~64	17	47	~27%

Infrastructure Coverage

Automatable Technical Controls: ~18-20 controls Automated: 13-15 controls Infrastructure Coverage: ~70-80% ✅

Control Layer Coverage

Layer	Controls	Coverage	Status
Validation Rules	28 checks	100%	✅ Complete
Guard Policies	15 rules	100%	✅ Complete
AWS Config	16 rules	100%	✅ Complete
Security Profile	25 settings	100%	✅ Complete

Testing Coverage

Control Category	Implemented	Production Tested	Status
Encryption (at-rest)	✅ Yes	✅ Yes	Complete
Encryption (in-transit)	✅ Yes	✅ Yes	Complete
Network Security	✅ Yes	✅ Yes	Complete
Access Control (IAM)	✅ Yes	✅ Yes	Complete
Authentication (Cognito/OIDC)	✅ Yes	⚠️ No	Action Required
Audit Logging	✅ Yes	✅ Yes	Complete
Threat Detection	✅ Yes	✅ Yes	Complete
Configuration Monitoring	✅ Yes	✅ Yes	Complete
High Availability	✅ Yes	✅ Yes	Complete
Backup/Recovery	✅ Yes	✅ Yes	Complete

Remediation Roadmap

Phase 1: Critical Gaps (Weeks 1-8)

Goal: Address high-priority manual controls required for SOC 2 compliance

Task	Owner	Timeline	Deliverable
Document organizational controls (CC1, CC2, CC3)	Compliance + Legal	Weeks 1-6	Policy manual, org charts, risk assessment
Create incident response plan (CC7.4, CC7.5)	Security	Weeks 2-3	IRP document, playbooks, tabletop report
Test authentication (Cognito/OIDC)	Engineering	Weeks 1-2	Test report, authentication documentation
Implement vendor management (CC9)	Procurement + Security	Weeks 4-6	Vendor inventory, SOC 2 reports

Success Criteria: All critical manual controls documented, authentication tested in production

Phase 2: Enhancements (Weeks 9-16)

Goal: Strengthen partial controls and add optional category controls

Task	Owner	Timeline	Deliverable
Document data disposal procedures (C1.2)	Engineering + Security	Weeks 9-10	Disposal procedures, S3 lifecycle policies
Implement application error detection (PI1.4)	Application Teams	Weeks 10-16	Error logging, validation rules
Privacy controls (if claiming Privacy)	Legal + Compliance	Weeks 9-16	Privacy policy, consent system, DSAR procedures
Advanced monitoring dashboards (CC4)	Engineering	Weeks 12-14	CloudWatch dashboards, governance reports

Success Criteria: All partial controls enhanced, optional categories documented

Phase 3: Continuous Improvement (Ongoing)

Goal: Maintain compliance, conduct regular reviews

Task	Frequency	Owner	Deliverable
Risk assessments	Annual + change-driven	Compliance	Risk assessment report
Vendor reviews	Annual	Procurement	Updated vendor assessments
Incident response testing	Quarterly	Security	Tabletop exercise reports
Policy reviews	Annual	Compliance + Legal	Updated policy manual
Control effectiveness reviews	Quarterly	Security + Compliance	Control review reports
Audit Manager evidence collection	Continuous	Automated	Evidence in S3 buckets

Success Criteria: Continuous compliance monitoring, regular evidence collection, proactive gap identification

Testing Status

Production-Tested Controls ✅

Control	Test Environment	Test Date	Status
EBS Encryption	Production	2025-Q4	✅ Pass
EFS Encryption (at-rest)	Production	2025-Q4	✅ Pass
EFS Encryption (in-transit)	Production	2025-Q4	✅ Pass
S3 Encryption	Production	2025-Q4	✅ Pass
RDS Encryption	Production	2025-Q4	✅ Pass
TLS/SSL (ALB)	Production	2025-Q4	✅ Pass
VPC Network Segmentation	Production	2025-Q4	✅ Pass
Security Groups	Production	2025-Q4	✅ Pass
IAM Password Policy	Production	2025-Q4	✅ Pass
Access Key Rotation	Production	2025-Q4	✅ Pass
CloudTrail Logging	Production	2025-Q4	✅ Pass
VPC Flow Logs	Production	2025-Q4	✅ Pass
GuardDuty	Production	2025-Q4	✅ Pass
AWS Config (16 rules)	Production	2025-Q4	✅ Pass
Multi-AZ Deployment	Production	2025-Q4	✅ Pass
Auto-scaling	Production	2025-Q4	✅ Pass
Automated Backups	Production	2025-Q4	✅ Pass

Not Yet Tested (Implemented) ⚠️

Control	Implementation Status	Test Requirement	Priority
Cognito Authentication	✅ Implemented	Production validation	HIGH
Cognito MFA	✅ Implemented	MFA enrollment and challenge	HIGH
ALB-OIDC (Identity Center)	✅ Implemented	End-to-end authentication flow	HIGH
ALB-OIDC (Generic providers)	✅ Implemented	Google, Okta, custom OIDC	MEDIUM
Session Timeout	✅ Implemented	12-hour timeout validation	MEDIUM
WAF Rules	✅ Implemented	SQL injection, XSS protection	MEDIUM
Cross-region Backup Failover	✅ Implemented	Disaster recovery drill	LOW

Test Plan for Authentication (High Priority)

Timeline: 1-2 weeks Owner: Engineering Team

Test Scenarios:

Cognito User Pool
- Create user pool with MFA enabled
- Register new user
- Enroll TOTP (authenticator app)
- Enroll SMS MFA
- Login with MFA challenge
- Verify password policy enforcement (14 chars, complexity)
- Test session timeout (1-hour token expiry, 1-day refresh)
ALB-OIDC (Identity Center)
- Configure ALB listener with OIDC
- Authenticate via AWS Identity Center
- Verify user claims in headers
- Test session management
ALB-OIDC (Google Workspace)
- Configure ALB listener with Google OIDC
- Authenticate via Google
- Verify group-based access control
Application-Level OIDC
- Configure Jenkins OIDC plugin
- Authenticate via OIDC provider
- Verify role-based access control (RBAC)

Success Criteria: All authentication flows tested, MFA enforced, session management validated

Maintenance & Updates

Document Review Schedule

Review Type	Frequency
Gap Analysis Update	Quarterly
Control Mapping Verification	Quarterly
Testing Status Update	Monthly
Remediation Roadmap Progress	Monthly
TSC Framework Updates	Annually

Change Log

Version	Date	Changes	Author
1.0	2025-12-14	Initial gap analysis	CloudForge CI maintainers
1.1	2025-12-16	Upgraded CC4, CC5, C1.2, PI1.4 from partial to fully documented	CloudForge CI maintainers
1.2	2025-12-19	Updated coverage metrics to reflect documented procedures; corrected inconsistencies	CloudForge CI maintainers

Maintenance Procedures

Quarterly Review Process

Update Testing Status
- Review newly tested controls
- Update production testing matrix
- Document test results
Verify Control Implementation
- Audit AWS Config rule deployment
- Verify Guard policy enforcement
- Check security profile settings
Gap Analysis Refresh
- Identify new gaps from infrastructure changes
- Update remediation priorities
- Review roadmap progress
Framework Updates
- Check for AICPA TSC updates
- Review AWS Config managed rule changes
- Update control mappings

When to Update This Document

Immediate Updates Required:

New control implementation completed
Control testing completed (move from ⚠️ to ✅)
TSC framework version change
Critical gap identified

Quarterly Updates:

Remediation roadmap progress
Control effectiveness metrics
Testing coverage statistics

Annual Updates:

Complete gap analysis refresh
Framework mapping verification
Coverage metrics recalculation

References

Official SOC 2 Documentation

Internal Documentation

Code References

Soc2Rules.java - Validation rules
soc2-trust-services.guard - Guard policies
ComplianceFactory.java - AWS Config deployment
ProductionSecurityProfileConfiguration.java - Security defaults
AuditManagerControlRegistry.java - Control mapping

Appendix: Quick Reference

SOC 2 Compliance Checklist

Infrastructure Controls (Automated) ✅

CC6.1: IAM password policy, access key rotation
CC6.2: MFA enforcement (implemented, needs testing)
CC6.6: VPC, security groups, network segmentation
CC6.7: TLS/SSL, encryption in transit
CC7.2: CloudTrail, GuardDuty, Config, Flow Logs
CC8.1: CloudTrail change tracking, IaC (Git)
A1.2: Multi-AZ, auto-scaling
A1.3: Automated backups, cross-region
C1.1: Encryption at rest (EBS, EFS, S3, RDS)

Manual Controls (Documentation Required) ❌

CC1: Organizational structure, governance, ethics
CC2: Security policies, communication procedures
CC3: Risk assessment framework, processes
CC7.4/7.5: Incident response plan, playbooks
CC9: Vendor management, third-party reviews
A1.1: SLA documentation, uptime commitments
C1.2: Data disposal procedures (partially automated)
PI1.1-PI1.4: Processing integrity controls (if claimed)
P1.0-P8.0: Privacy controls (if claimed)

Document End

For questions or updates to this document, contact the Security & Compliance Team.

Document Purpose​

Table of Contents​

Executive Summary​

Overall Coverage​

Infrastructure Controls​

Critical Gaps​

SOC 2 Framework Overview​

Trust Services Categories (2017 AICPA)​

Implementation Architecture​

Layer 1: Validation Rules (Pre-Synthesis)​

Layer 2: CloudFormation Guard Policies (Pre-Deployment)​

Layer 3: AWS Config Rules (Runtime Monitoring)​

Layer 4: Security Profile Configuration (Infrastructure Defaults)​

Detailed Control Mapping​

Common Criteria (CC) - Security (Mandatory)​

CC6.1 - Logical and Physical Access Controls​

CC6.2 - Access Management​

CC6.6 - Network Segmentation​

CC6.7 - Data Transmission Security​

CC7.2 - System Monitoring​

CC8.1 - Change Management​

CC1, CC2, CC3, CC4, CC5, CC9 - Organizational Controls​

CC7.1, CC7.3, CC7.4, CC7.5 - Additional System Operations​

Availability (A) (Optional Category)​

A1.2 - System Availability​

A1.3 - Recovery Capabilities​

A1.1 - Availability Commitments​

Confidentiality (C) (Optional Category)​

C1.1 - Confidentiality Commitments​

C1.2 - Information Disposal​

Processing Integrity (PI) (Optional Category)​

Privacy (P) (Optional Category)​

Infrastructure Verification​

AWS Config Rules Deployment​

Base Controls (Always Deployed)​

SOC2-Specific Controls (Conditional)​

CloudFormation Guard Policies​

Access Control Rules​

Encryption at Rest Rules​

Encryption in Transit Rules​

Monitoring Rules​

Backup and Recovery Rules​

Security Profile Enforcement​

Control Registry & Evidence Mapping​

Gap Analysis​

Critical Gaps (Require Manual Implementation)​

1. Organizational Controls (CC1, CC2, CC3)​

2. Incident Response Procedures (CC7.4, CC7.5)​

3. Vendor Management (CC9)​

4. Privacy Controls (P1-P8) (If Privacy Category Claimed)​

Partial Gaps (Enhance Existing Controls)​

1. C1.2 - Information Disposal​

2. PI1.4 - Error Detection and Correction​

3. Authentication Testing (CC6.2)​

Coverage Metrics​

Overall TSC Coverage​

Infrastructure Coverage​

Control Layer Coverage​

Testing Coverage​

Remediation Roadmap​

Phase 1: Critical Gaps (Weeks 1-8)​

Phase 2: Enhancements (Weeks 9-16)​

Phase 3: Continuous Improvement (Ongoing)​

Testing Status​

Production-Tested Controls ✅​

Not Yet Tested (Implemented) ⚠️​

Test Plan for Authentication (High Priority)​

Maintenance & Updates​

Document Review Schedule​

Change Log​

Maintenance Procedures​

Quarterly Review Process​

When to Update This Document​

References​

Official SOC 2 Documentation​

Internal Documentation​

Code References​

Appendix: Quick Reference​

SOC 2 Compliance Checklist​

Infrastructure Controls (Automated) ✅​

Document Purpose

Table of Contents

Executive Summary

Overall Coverage

Infrastructure Controls

Critical Gaps

SOC 2 Framework Overview

Trust Services Categories (2017 AICPA)

Implementation Architecture

Layer 1: Validation Rules (Pre-Synthesis)

Layer 2: CloudFormation Guard Policies (Pre-Deployment)

Layer 3: AWS Config Rules (Runtime Monitoring)

Layer 4: Security Profile Configuration (Infrastructure Defaults)

Detailed Control Mapping

Common Criteria (CC) - Security (Mandatory)

CC6.1 - Logical and Physical Access Controls

CC6.2 - Access Management

CC6.6 - Network Segmentation

CC6.7 - Data Transmission Security

CC7.2 - System Monitoring

CC8.1 - Change Management

CC1, CC2, CC3, CC4, CC5, CC9 - Organizational Controls

CC7.1, CC7.3, CC7.4, CC7.5 - Additional System Operations

Availability (A) (Optional Category)

A1.2 - System Availability

A1.3 - Recovery Capabilities

A1.1 - Availability Commitments

Confidentiality (C) (Optional Category)

C1.1 - Confidentiality Commitments

C1.2 - Information Disposal

Processing Integrity (PI) (Optional Category)

Privacy (P) (Optional Category)

Infrastructure Verification

AWS Config Rules Deployment

Base Controls (Always Deployed)

SOC2-Specific Controls (Conditional)

CloudFormation Guard Policies

Access Control Rules

Encryption at Rest Rules

Encryption in Transit Rules

Monitoring Rules

Backup and Recovery Rules

Security Profile Enforcement

Control Registry & Evidence Mapping

Gap Analysis

Critical Gaps (Require Manual Implementation)

1. Organizational Controls (CC1, CC2, CC3)

2. Incident Response Procedures (CC7.4, CC7.5)

3. Vendor Management (CC9)

4. Privacy Controls (P1-P8) (If Privacy Category Claimed)

Partial Gaps (Enhance Existing Controls)

1. C1.2 - Information Disposal

2. PI1.4 - Error Detection and Correction

3. Authentication Testing (CC6.2)

Coverage Metrics

Overall TSC Coverage

Infrastructure Coverage

Control Layer Coverage

Testing Coverage

Remediation Roadmap

Phase 1: Critical Gaps (Weeks 1-8)

Phase 2: Enhancements (Weeks 9-16)

Phase 3: Continuous Improvement (Ongoing)

Testing Status

Production-Tested Controls ✅

Not Yet Tested (Implemented) ⚠️

Test Plan for Authentication (High Priority)

Maintenance & Updates

Document Review Schedule

Change Log

Maintenance Procedures

Quarterly Review Process

When to Update This Document

References

Official SOC 2 Documentation

Internal Documentation

Code References

Appendix: Quick Reference

SOC 2 Compliance Checklist

Infrastructure Controls (Automated) ✅