Control Self-Assessment — October 2026¶
Purpose. A dated, signed-off assessment of every control in the SOC 2 Type 1 checklist: whether it is operating, and if not, what is missing and who has it. It follows the first pass in the SOC 2 Type 1 Readiness form (2026-09-01) and takes in the auditor's spot check (Will Ruskin, GetAgency, 2026-09-24). Repeated quarterly.
A self-assessment that finds nothing was not really done. This one corrects four rows that the 9 September sheet marked Done without the evidence to back them (2, 47, 59, 60).
Assessment date: 13 October 2026 · Assessed by: the ISMS, against the evidence store, the repository and Linear · Reviewed and approved by: the Information Security Manager (approval front-matter)
Summary¶
🟡 In hand: 8, ✅ Operating: 53, ➖ N/A: 4, 🔴 Gap: 3 of 68 controls.
Rows still 🔴 or 🟡 are tracked in Linear project SOC 2 Type 1 — audit readiness. Each closes when its evidence is filed against the checklist row.
Controls¶
| Row | CC | Control | Status | Basis / open item |
|---|---|---|---|---|
| 1 | CC1.1 | Code of conduct & disciplinary policy | 🟡 In hand | HR Security Policy (incl. §2.3 disciplinary) and Acceptable Use Policy approved. Signed policy acknowledgements issued to all five people on 13 Oct. |
| 2 | CC1.1 | Confidentiality agreements (NDAs) | 🟡 In hand | NDA template approved. Signed confidentiality agreements (founder undertakings, CyberSquad NDA) issued for signature 13 Oct. The 9 Sep pack held only the template. |
| 3 | CC1.1 | Employment agreements | 🟡 In hand | Founder Confidentiality & Security Undertaking approved (2026-09-01). One signed copy per founder issued 13 Oct. |
| 4 | CC1.1 | Contractor agreements | 🟡 In hand | CyberSquad agreement v0.3 issued for signature 13 Oct (unsigned since 1 Sep). |
| 5 | CC1.2 | Board / leadership oversight of security | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 6 | CC1.2 | Board charter | ➖ N/A | No separate board: four founder-shareholders. Accepted by GetAgency (Tad Kozusko, 24 Sep). |
| 7 | CC1.2 | Board expertise documented | ➖ N/A | As row 6. Accepted 24 Sep. |
| 8 | CC1.3 | Org chart & defined reporting lines | 🟡 In hand | Dated organisation chart ISMS-DOC-05-5 drafted; approval gives it its date. Undated screenshots set aside. |
| 9 | CC1.3 | Assign a security owner | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 10 | CC1.4 | Job descriptions & competence | ✅ Operating | Roles, Responsibilities & Authorities (ISMS-DOC-05-2 v0.3, approved 2026-09-08) serves as the job descriptions, as the auditor suggested. |
| 11 | CC1.4 | Background checks | 🟡 In hand | HR Security Policy §2.1: founders not screened by design; no non-founder hires. External consultant's screening record ISMS-FORM-A06-1-2 awaiting the ISM's completion. |
| 12 | CC1.5 | Performance reviews & accountability | ➖ N/A | No employees to review. Accepted 24 Sep. |
| 13 | CC2.1 | Information Security Policy | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 14 | CC2.2 | Security awareness training | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 15 | CC2.2 | Policies shared with all staff | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 16 | CC2.2 | Whistleblower policy & anonymous channel | ➖ N/A | No staff to protect anonymously at this size; reporting channels in row 21. Accepted 24 Sep. |
| 17 | CC2.2 | System changes communicated to staff | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 18 | CC2.3 | Customer-facing security commitments | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 19 | CC2.3 | Master Service Agreement (MSA) | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 20 | CC2.3 | System Description | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 21 | CC2.3 | Channel for reporting security concerns | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 22 | CC2.3 | Customer support channel | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 23 | CC2.3 | Customers notified of critical changes | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 24 | CC3.1 | Defined business & security objectives | ✅ Operating | Information Security Objectives & Plan v0.3 approved 2026-09-29. |
| 25 | CC3.2 | Annual risk assessment | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 26 | CC3.3 | Fraud risk considered | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 27 | CC3.4 | Assess impact of major changes | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 28 | CC4.1 | Periodic control self-assessment | ✅ Operating | This document. |
| 29 | CC4.2 | Track and remediate deficiencies | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 30 | CC5.1 | Controls mapped to risks | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 31 | CC5.2 | Technology controls selected | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 32 | CC5.3 | Policies enacted through procedures | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 33 | CC6.1 | Access control policy & least privilege | ✅ Operating | Access Control Policy v0.5 approved 2026-09-29. |
| 34 | CC6.1 | MFA on all critical systems | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 35 | CC6.1 | Password manager & password policy | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 36 | CC6.1 | Data classification policy | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 37 | CC6.1 | Production asset inventory | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 38 | CC6.2 | Access provisioning on hire | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 39 | CC6.3 | Access removal on departure & quarterly review | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 40 | CC6.4 | Physical access / office & devices | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 41 | CC6.5 | Secure disposal of data & devices | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 42 | CC6.5 | Data retention & disposal procedures | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 43 | CC6.5 | Customer data deletion on departure | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 44 | CC6.6 | Perimeter protection (firewalls, network) | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 45 | CC6.6 | Network segmentation & diagram | 🟡 In hand | Network Architecture & Segmentation ISMS-DOC-A08-22-1 drafted from the OpenTofu source; awaiting approval. |
| 46 | CC6.6 | Annual firewall rule review | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 47 | CC6.7 | Encryption in transit | 🟡 In hand | TLS everywhere, but pentest finding #1: legacy CBC/RSA suites still accepted at Cloudflare's edge for app.soon.works (S-607). The API load balancer already refuses them. |
| 48 | CC6.7 | Encryption at rest | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 49 | CC6.7 | Encryption key management | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 50 | CC6.8 | Endpoint protection & malware defense | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 51 | CC7.1 | Vulnerability & patch management | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 52 | CC7.1 | Annual penetration test | ✅ Operating | Penetration test 21–22 Sep 2026, report 24 Sep: low risk, 1 low and 3 informational. Remediation and risk acceptance: ISMS-FORM-A08-8-3. |
| 53 | CC7.1 | Hardening standards | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 54 | CC7.2 | Logging in your cloud environment | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 55 | CC7.2 | Intrusion detection (IDS) | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 56 | CC7.2 | Infrastructure & performance monitoring | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 57 | CC7.3 | Security incidents evaluated | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 58 | CC7.4 | Incident response plan | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 59 | CC7.4 | Annual incident response test | 🔴 Gap | Not yet operating. The incident-response test had not been held. The 9 Sep sheet showed this row as Done without evidence; corrected here. Exercise pack ISMS-FORM-A05-30-2. |
| 60 | CC7.5 | Recovery from incidents (backups & restore test) | 🔴 Gap | Not yet operating. Backup Policy approved, but the first restore test (S-412) had not been run. Corrected from Done. To be performed live in the ISMS-FORM-A05-30-2 exercise. |
| 61 | CC8.1 | Change management process | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 62 | CC8.1 | Infrastructure changes controlled | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 63 | CC8.1 | SDLC policy | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 64 | CC8.1 | Configuration management | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 65 | CC9.1 | Business continuity / disaster recovery plan | ✅ Operating | Business Continuity & Disaster Recovery Plan ISMS-DOC-A05-30-1 approved 2026-09-01. The 9 Sep pack attached the availability policy instead; corrected. |
| 66 | CC9.1 | Tabletop disaster recovery test (annual) | 🔴 Gap | Not yet operating. DR tabletop not yet held; same exercise as rows 59–60. |
| 67 | CC9.2 | Vendor management & review | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
| 68 | CC9.2 | Vendor agreements with confidentiality terms | ✅ Operating | Evidenced in the 9 September 2026 pack; no change since. |
Change log¶
| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 | 2026-10-13 | ISMS | First quarterly self-assessment, for checklist row 28 (CC4.1). |