Class Soc2Rules

java.lang.Object

com.cloudforgeci.api.core.rules.Soc2Rules

All Implemented Interfaces:

FrameworkRules<SystemContext>

@ComplianceFramework(value="SOC2",
                     priority=40,
                     displayName="SOC 2",
                     description="Validates SOC 2 Trust Services Criteria for service organizations")
public class Soc2Rules
extends Object
implements FrameworkRules<SystemContext>

SOC 2 (Service Organization Control 2) Trust Services Criteria compliance validation. SOC 2 is based on five Trust Services Criteria (TSC): - Security (Common Criteria - CC) - Availability (A) - Processing Integrity (PI) - Confidentiality (C) - Privacy (P) This validator focuses on the Security criteria (Common Criteria) which apply to all SOC 2 reports. Organizations can choose additional criteria based on their services. Trust Services Criteria Coverage: - CC6.1: Logical and Physical Access Controls - CC6.2: Access Management - CC6.6: Network Segmentation - CC6.7: Data Transmission - CC7.2: System Monitoring - CC7.3: Environmental Protections (Availability) - CC8.1: Change Management

Constructor Summary

Constructors

Constructor	Description
Soc2Rules()

Method Summary

Modifier and Type	Method	Description
Set<String>	claimedControls()	Controls checked across every validate* method above -- see FrameworkRules.claimedControls().
String	generateComplianceReport(SystemContext ctx)	Generate SOC 2 Trust Services Criteria compliance report.
void	install(SystemContext ctx)	Install SOC 2 compliance validation rules.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface FrameworkRules

alwaysLoad, description, displayName, frameworkId, getRequiredConfiguration, priority

Constructor Details

Soc2Rules

public Soc2Rules()

Method Details

install

public void install(SystemContext ctx)

Install SOC 2 compliance validation rules. SOC 2 applies to production and staging environments serving customers.

Specified by:

install in interface FrameworkRules<SystemContext>

Parameters:

ctx - the system context containing deployment configuration and CDK stack

Since:

3.0.0

claimedControls

public Set<String> claimedControls()

Controls checked across every validate* method above -- see FrameworkRules.claimedControls(). Controls the matrix marks REQUIRED for SOC2 but left off this list belong to always-load cross-framework classes instead (CDN_SECURITY, CERTIFICATE_MANAGEMENT, CONTAINER_SECURITY, CREDENTIAL_ROTATION, DATABASE_ACCESS_CONTROL, DATABASE_LOGGING, DATABASE_PITR, INSTANCE_METADATA_SECURITY, LAMBDA_SECURITY, ROOT_ACCOUNT_PROTECTION, SNS_KMS_ENCRYPTION, API_SECURITY -- see KeyManagementRules, DatabaseSecurityRules, IamSecurityRules and similar), except LAMBDA_SECURITY and DATABASE_ACCESS_CONTROL (genuine gaps: no class anywhere checks them).

Specified by:

claimedControls in interface FrameworkRules<SystemContext>

Returns:

the control identifiers this framework's install() validates; empty if undeclared

generateComplianceReport

public String generateComplianceReport(SystemContext ctx)

Generate SOC 2 Trust Services Criteria compliance report.