Skip to content

Your SOC 2 tasks

Target: hand the evidence pack to GetAgency by Friday 11 September. Find your name, do the things, capture the evidence. Everything here is also in Linear.

The weekly slot — Thursday 13:00–14:00 CEST

27 Aug · 3 Sep · 10 Sep. It is a working session, not a status meeting. Join with your laptop open and capture your evidence live on the call. Screenshots assigned as homework do not happen — that is exactly why the last plan slipped.

Plus 15 minutes Monday 09:15, or async in #Security before 10:00.

Thomas — the technical track

Four of these are gaps between what we already tell customers and what is actually configured. That is why they are first.

Task Why now Linear
1 Branch protection on main — all six repos: require a PR, 1 approval, Code Owner review, status checks, no force push Verified 22 Aug: no repo has any protection or ruleset. Rows #61/#62/#64 are marked Done and soon.works/trust says every change is peer-reviewed. One API call disproves it S-405
2 GitHub org-wide 2FA two_factor_requirement_enabled: false. Warn the team first — members without 2FA get removed and need re-inviting S-406
3 Sentry: sendDefaultPii: false + enable scrubbing + confirm the project region soon-server/src/instrument.js:19 sends PII by default and beforeSend does no scrubbing. Live GDPR exposure S-407
4 Revoke the DeepSeek / Mistral / xAI keys; prune the CSP allowlist Unused live credentials, and ~10 dead domains each of which is a permitted exfiltration route S-408
5 ✅ Done 19 Aug — public DB endpoint removed. Now: capture the evidence (PubliclyAccessible: false + the security-group export) and delete the unattached legacy security groups We can assert it; we can't yet show it, and CC6.6 turns on showing it S-299
6 First quarterly access review — AWS IAM, GitHub, Workspace, WorkOS. Export the lists, mark each row keep/remove, sign it Never performed. The row needs the record, not the policy —
7 Network diagram — VPC, subnets, security groups, data path. Draw it from soon-terraform/modules/network Row #45, and the auditor will use it to frame questions —
8 Annual firewall / security-group review — walk every rule, delete the legacy groups in the S-299 runbook step 5, sign the record Row #46 wants a performed review —

The big one is already closed

The public database endpoint was removed on 19 August (soon-server#1675), which takes the qualified-opinion risk off the table. Engineers now reach the database through SSM Session Manager — see Production Database Access §2.

What's left is evidential. A control an auditor can't see tested is one they treat as absent, so the config export is worth more than the fix being done.

Alessandro — the paperwork and people track

None of this needs AWS or the codebase. Roughly a day and a half spread over three weeks, and it unblocks nine checklist rows that nobody else is going to pick up.

Task What good looks like Linear
1 Org chart + job descriptions A diagram of the four founders + Andrea showing reporting lines and — the part the auditor actually wants — who owns security (Olaf). Then one paragraph per founder: role, security responsibilities, competence. §1 of Roles & Responsibilities already has the prose S-409
2 Signed NDAs and agreements Do not send the existing NDA to the founders — it is a one-way third-party agreement with unfilled brackets. Founders get the new Founder Undertaking; Andrea gets the NDA with its three blanks filled. Then fill in the Schedule S-410
3 Vendor DPAs and SOC 2 reports One folder per vendor in Drive → Legal → Vendors, for the 12 core sub-processors in the register. Download the PDFs — a link is not evidence of what the terms said on the audit date S-411
4 Training round — schedule all four founders + Andrea through /isms:onboard, and collect the acknowledgement form The training log is currently empty, which is what rows #14 and #18 read from. Run it as one round, not person by person —
5 Device attestation round Each person completes the Device Security Standard checklist and screenshots FileVault, firewall, screen-lock timeout and OS version. Makes the no-MDM position evidenced rather than asserted —

Andrea is your brother — so Olaf signs, not you

On the CyberSquad paperwork specifically. It is recorded as a related-party relationship in Roles & Responsibilities §1.7, and a countersignature from you would create the exact problem that note exists to manage.

Melvin — infrastructure

Task Why Linear
1 Restore test — restore the latest snapshot to a throwaway instance, verify a known table, record the timings, delete it The single most-cited SOC 2 gap. "PITR is enabled" is not an answer; a backup never restored is a hypothesis. The timings also fill in the BC/DR Plan S-412
2 Isolated backup copy — AWS Backup vault in the log-archive account + a copy to eu-central-1 (~€25/month) Today one account compromise destroys the database and all 30 days of snapshots —

Olaf — approvals, decisions, handover

Task Linear
1 Fix the evidence store — the KMS key does not resolve, so nothing can be filed and soon-grc has failed daily since 18 Aug S-413
2 Settle the report mechanics with Tad — management assertion, Trust Services Categories, as-of date, carve-out method S-416
3 Approve the ready policy set — 30 documents with no open questions S-414
4 IR + DR tabletop, 90 minutes, minuted — the only two rows still Not started S-415
5 Trust Center fix, Chatbot → Slack, the remaining owner decisions, handover —

Capturing evidence — one command

Everything above ends in an artefact. The tool stamps a visible timestamp into the image, hashes it, files it in the WORM store, and logs it:

python3 tools/evidence.py shot --control A.5.17 --desc mfa-enforced-github --soc2 34 --cc CC6.1

Run this once per machine so full-screen captures carry the system clock too — it is the first thing an auditor looks for:

python3 tools/evidence.py clock

The store is not accepting uploads yet

A KMS problem is blocking every write (S-413). Capture into a folder in the meantime; the tool will file the backlog once it is fixed.

Screenshot rules: whole window including the URL bar or CLI prompt so the account and system are visible · a date visible somewhere · the real setting, not a cropped fragment · redact secrets by drawing over, never by cropping out context.

The full picture