The posture score is the automated pass rate only. It does not include manual-control status, does not weight severity, and a high score with critical failures or stale evidence is not audit readiness. "Without current evidence" counts manual controls that are unattested, attested non-compliant, or past their next review date.
| Check | Provider | Framework · Criteria | Severity | Status |
|---|---|---|---|---|
| CloudTrail enabled in all regions CloudTrail must be enabled in all regions to provide the activity logs required as SOC 2 audit evidence. |
aws | SOC2 · CC7.2 | critical | FAIL |
| CloudTrail log file validation enabled Log file validation ensures logs have not been tampered with — required for integrity evidence. |
aws | SOC2 · CC7.2 | high | PASS |
| CloudWatch alarm for root account usage A CloudWatch alarm must fire whenever the root account is used — required by CIS Benchmark 1.7. |
aws | SOC2 · CC7.2 | high | PASS |
| CloudWatch log groups retain at least 12 months Every CloudWatch log group used for audit evidence must retain at least 365 days of history. Short retention (7/30 day) defaults from CDK/Terraform stacks fail PCI 10.5.1 and weaken SOC 2 detection evidence. |
aws | SOC2 · CC7.2 | high | PASS |
| EBS default encryption enabled EBS default encryption ensures all new volumes are encrypted automatically. |
aws | SOC2 · CC6.1 | high | PASS |
| GuardDuty enabled in all regions Amazon GuardDuty provides continuous threat detection and must be active in every region. |
aws | SOC2 · CC7.2 | critical | FAIL |
| Load balancer HTTPS listeners require TLS 1.2 or higher Every ALB and NLB HTTPS/TLS listener must use a security policy that requires TLSv1.2 or higher. Policies permitting TLSv1.0/1.1 fail PCI 4.2.1 (SSL/early-TLS are explicitly retired by PCI SSC). |
aws | SOC2 · CC6.1 | high | PASS |
| MFA enabled for all IAM users All IAM users with console access must have MFA enabled. Users without MFA are an immediate audit finding. |
aws | SOC2 · CC6.1 | critical | PASS |
| No credentials unused for 90+ days IAM credentials unused for 90 or more days should be disabled or removed. |
aws | SOC2 · CC6.2 | high | PASS |
| No security groups expose SSH/RDP/DB ports to the internet Security groups must not allow 0.0.0.0/0 access to administrative or database ports (SSH, RDP, Postgres, MySQL, MSSQL, MongoDB, Redis, Elasticsearch, Memcached). PCI 1.4.1 explicitly requires restricting inbound traffic from untrusted networks. |
aws | SOC2 · CC6.1 | critical | PASS |
| RDS instances encrypted at rest All RDS database instances must have storage encryption enabled. |
aws | SOC2 · CC6.1 | high | FAIL |
| RDS instances enforce TLS at the parameter group Every RDS instance (Postgres, MySQL/MariaDB, SQL Server, Aurora) must enforce TLS at the parameter-group level: rds.force_ssl=1 or require_secure_transport=ON. Enabling TLS support is not enough — clients can still connect in plaintext unless the engine rejects them. PCI 4.2.1 requires this end-to-end. |
aws | SOC2 · CC6.1 | high | PASS |
| RDS instances use non-default master username The RDS master username cannot be renamed after creation. Well-known defaults (admin, postgres, root, sa, mysql, oracle, master) are the first attackers try in credential spraying and fail PCI 2.2.5 (vendor defaults). |
aws | SOC2 · CC6.1 | medium | PASS |
| Root account has no active access keys The AWS root account should never have active access keys. Root keys cannot be scoped and represent full account compromise if leaked. |
aws | SOC2 · CC6.1 | critical | FAIL |
| S3 buckets encrypted at rest All S3 buckets must have server-side encryption enabled (SSE-S3 or SSE-KMS). |
aws | SOC2 · CC6.1 | high | PASS |
| S3 public access block enabled All S3 buckets should have public access blocked at the account level. |
aws | SOC2 · CC6.1 | critical | PASS |
| S3 versioning enabled on critical buckets Versioning protects against accidental deletion and supports availability commitments. |
aws | SOC2 · A1.2 | medium | FAIL |
| Strong password policy configured IAM password policy must enforce minimum length (14+), complexity, and rotation requirements. |
aws | SOC2 · CC6.1 | high | PASS |
| VPC Flow Logs enabled VPC Flow Logs capture network traffic and are required for security monitoring and incident investigation. |
aws | SOC2 · CC7.2 | high | FAIL |
| Azure Activity Log diagnostic settings configured Activity Log diagnostic settings must be configured to retain Administrative, Security, Alert, and Policy events. |
azure | SOC2 · CC7.2 | critical | FAIL |
| Azure Key Vault in use for secrets management At least one Key Vault must exist in the subscription to manage application secrets, keys, and certificates. |
azure | SOC2 · CC6.1 | high | PASS |
| Azure PostgreSQL enforces SSL Every Azure Database for PostgreSQL Flexible Server should have require_secure_transport = ON so client connections must use TLS. |
azure | SOC2 · CC6.1 | high | FAIL |
| Azure SQL Transparent Data Encryption enabled Every user database on every Azure SQL server should have Transparent Data Encryption (TDE) enabled — on by default for new databases but can be disabled per-database. |
azure | SOC2 · CC6.1 | high | FAIL |
| Azure SQL server-level auditing enabled Every Azure SQL logical server should have server-level auditing enabled to capture data plane and management events. |
azure | SOC2 · CC7.2 | medium | PASS |
| Azure Storage account public blob access disabled All storage accounts must have Allow Blob Public Access set to Disabled to prevent unintentional data exposure. |
azure | SOC2 · CC6.1 | critical | FAIL |
| Azure managed disks encrypted at rest All Azure managed disks must use platform-managed or customer-managed encryption at rest. |
azure | SOC2 · CC6.1 | high | FAIL |
| Key Vaults use Azure RBAC Every Key Vault should use Azure RBAC for data-plane authorization instead of the legacy access-policy model, so access changes surface in IAM reviews. |
azure | SOC2 · CC6.1 | medium | FAIL |
| Log Analytics workspaces retain logs for 90+ days Every Log Analytics workspace should retain logs for at least 90 days so security-relevant events remain queryable during an audit window. |
azure | SOC2 · CC7.2 | medium | PASS |
| MFA enforced via Security Defaults or Conditional Access MFA must be enforced for all users via Azure Security Defaults or a Conditional Access policy. |
azure | SOC2 · CC6.1 | critical | FAIL |
| Microsoft Defender for Cloud enabled on key workloads Defender for Cloud Standard tier must be enabled for VMs, SQL, App Services, Storage, and Containers. |
azure | SOC2 · CC7.2 | high | PASS |
| No NSG rule opens SSH/RDP to the internet No Network Security Group rule should allow inbound TCP 22 or 3389 from Internet / 0.0.0.0/0 / *. |
azure | SOC2 · CC6.6 | critical | PASS |
| No stale Azure AD guest users Guest users who have not signed in for 90+ days (or have never signed in and were invited 90+ days ago) should be reviewed and removed. |
azure | SOC2 · CC6.2 | medium | PASS |
| Privileged Identity Management activated for admin roles Global Administrator and Privileged Role Administrator assignments should be managed through Privileged Identity Management (PIM) as just-in-time eligibilities, not permanent active assignments. Requires Entra ID P2 licensing. |
azure | SOC2 · CC6.2 | medium | PASS |
| Storage accounts require HTTPS Every storage account should have 'Secure transfer required' enabled so blob, file, queue, and table endpoints reject cleartext HTTP. |
azure | SOC2 · CC6.1 | high | FAIL |
| 2-Step Verification enforced for all Google Workspace users All Google Workspace users must be enrolled in 2-Step Verification. Requires domain-wide delegation to the Admin SDK. |
gcp | SOC2 · CC6.1 | critical | PASS |
| Cloud Audit Logs enabled for all services Cloud Audit Logs must capture Admin Activity, Data Read, and Data Write events for all services at the project level. |
gcp | SOC2 · CC7.2 | critical | FAIL |
| Cloud SQL instances encrypted at rest All Cloud SQL instances should have encryption at rest enabled — Google-managed by default, or CMEK for stronger key custody. |
gcp | SOC2 · CC6.1 | high | FAIL |
| Cloud SQL requires SSL connections Cloud SQL instances should require SSL/TLS for all connections to prevent credential and data exposure over the wire. |
gcp | SOC2 · CC6.1 | high | PASS |
| Compute Engine disks are encrypted Every Compute Engine persistent disk should be encrypted, either with a customer-managed key (CMEK) or the default Google-managed key. |
gcp | SOC2 · CC6.1 | high | PASS |
| GCS buckets block public access All Cloud Storage buckets must have Public Access Prevention enforced and no allUsers/allAuthenticatedUsers IAM bindings. |
gcp | SOC2 · CC6.1 | critical | PASS |
| KMS symmetric keys rotate within 90 days Every Cloud KMS symmetric encryption key should have automated rotation enabled with a period of 90 days or less. |
gcp | SOC2 · CC6.1 | medium | PASS |
| Long-term log sink configured At least one log sink should route project logs to BigQuery, Cloud Storage, Pub/Sub, or a custom log bucket to meet the 12-month audit-log retention requirement. |
gcp | SOC2 · CC7.2 | medium | PASS |
| No firewall rule opens SSH/RDP to the internet No VPC firewall rule should allow ingress to TCP 22 or 3389 from 0.0.0.0/0 — the most common exploit path for GCE instances. |
gcp | SOC2 · CC6.6 | critical | PASS |
| OS Login is enforced at the project level OS Login centralizes SSH access to Compute Engine through IAM identities instead of instance metadata keys; enforce it project-wide. |
gcp | SOC2 · CC6.2 | medium | PASS |
| Primitive IAM roles (Owner/Editor) not assigned to users The Owner and Editor primitive roles grant broad permissions and should not be assigned to human users in production. |
gcp | SOC2 · CC6.1 | high | PASS |
| Service account keys not older than 90 days User-managed service account keys older than 90 days should be rotated to reduce credential compromise risk. |
gcp | SOC2 · CC6.2 | high | FAIL |
| The default VPC network has been removed The auto-created 'default' VPC ships with permissive firewall rules and no flow logs; every benchmark recommends deleting it in production projects. |
gcp | SOC2 · CC6.6 | medium | PASS |
| Uniform bucket-level access enabled on GCS buckets Uniform bucket-level access must be enabled to ensure consistent IAM-only access control with no legacy ACLs. |
gcp | SOC2 · CC6.1 | high | PASS |
| VPC Flow Logs enabled on all subnets VPC Flow Logs must be enabled on all subnets to capture network traffic for security monitoring and incident investigation. |
gcp | SOC2 · CC7.2 | high | FAIL |
| 2FA required for all org members GitHub organization must require 2FA for all members. |
github | SOC2 · CC6.1 | critical | PASS |
| Default branch protection enabled Main/master branch must require PR reviews before merging. Direct pushes are a change management finding. |
github | SOC2 · CC8.1 | critical | FAIL |
| Dependabot security alerts enabled Dependabot must be enabled on all repositories to detect known vulnerabilities in dependencies. |
github | SOC2 · CC7.1 | high | PASS |
| Required status checks on default branch CI checks must pass before merging to default branch. |
github | SOC2 · CC8.1 | high | FAIL |
| Secret scanning enabled GitHub secret scanning detects accidentally committed credentials. |
github | SOC2 · CC6.1 | high | PASS |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| NDAs signed by all employees Confidentiality and non-disclosure agreements are signed by all employees and contractors. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
SOC2 · CC1.4 | COMPLIANT | Sarah Chen | 2026-07-05 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e6163636573732e6e64613a64656d6f |
| Offboarding access revoked within 24h System access for terminated employees is revoked within 24 hours of separation. |
SOC2 · CC6.2 | NOT STARTED | — | — | — |
| Privileged access reviewed quarterly Administrator and privileged accounts are reviewed quarterly. Access is granted on least-privilege principles. |
SOC2 · CC6.3 | NOT STARTED | — | — | — |
| Quarterly user access review User access to production systems and sensitive data is formally reviewed and certified every quarter. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
SOC2 · CC6.2 | COMPLIANT | Sarah Chen | 2026-07-05 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e6163636573732e717561727465726c795f7265766965773a64 |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Information asset inventory maintained An inventory of information and associated assets (systems, data, media, cloud services) is maintained together with ownership and classification. Reviewed at least annually and updated when assets are added or retired. |
ISO27001 · 5.9 | NOT STARTED | — | — | — |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Annual disaster recovery test A disaster recovery test has been conducted in the current year and results have been reviewed by management. |
SOC2 · A1.2 | NOT STARTED | — | — | — |
| Application and data criticality analysis The relative criticality of specific applications and data in support of contingency planning has been assessed and documented: which systems hold or process ePHI, their recovery priority, and the maximum tolerable downtime for each. |
HIPAA · 164.308(a)(7)(ii)(E) | NOT STARTED | — | — | — |
| Business continuity plan documented A business continuity plan has been reviewed, approved, and covers recovery time and recovery point objectives. |
SOC2 · CC9.1 | NOT STARTED | — | — | — |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Cardholder data flow diagram documented A current diagram exists showing how cardholder data enters, is processed by, and leaves your systems (Stripe hosted Checkout, iframe, redirect). Reviewed and updated at least annually or upon any material change to the flow. |
PCI · 12.5.2 | NOT STARTED | — | — | — |
| Payment-page script inventory + authorization A list of every script loaded on any page that accepts payment card data (including SAQ A hosted-Checkout redirect pages) is maintained with a documented business justification for each. Any script not on the list is treated as unauthorized. |
PCI · 6.4.3 | NOT STARTED | — | — | — |
| Quarterly PCI scope confirmation Every quarter, the CDE boundary is re-confirmed: what systems store, process, or transmit PAN; what systems are connected-to or security-impacting; what is out of scope and why. Changes are documented. |
PCI · 12.5.2 | NOT STARTED | — | — | — |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Change management approval process All production changes go through a documented approval process including testing requirements and rollback procedures. |
SOC2 · CC8.1 | NOT STARTED | — | — | — |
| Security requirements in SDLC Security requirements are incorporated into the software development lifecycle including code review and security testing. |
SOC2 · CC8.1 | NOT STARTED | — | — | — |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Annual CMMC L1 self-assessment and SPRS affirmation A CMMC Level 1 self-assessment against all 17 practices has been completed within the past 12 months, and a senior official has affirmed continuing compliance in the Supplier Performance Risk System (SPRS). The assessment record and the affirmation date are retained. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
CMMC · 32 CFR 170.22 | COMPLIANT | Sarah Chen | 2026-07-03 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e636d6d632e737072735f61666669726d6174696f6e3a64656d |
| FCI scoping documented The systems, storage locations, and external connections that store, process, or transmit Federal Contract Information are identified and documented, including which contracts the FCI relates to. Reviewed at least annually and when systems or contracts change. Knowing where FCI lives is the precondition for limiting access to it. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
CMMC · AC.L1-3.1.1 | COMPLIANT | Sarah Chen | 2026-07-03 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e636d6d632e6663695f73636f70696e673a64656d6f |
| HIPAA security official designated A specific individual is formally designated as the security official responsible for developing and implementing the Security Rule policies and procedures. The designation is documented and current. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
HIPAA · 164.308(a)(2) | COMPLIANT | Sarah Chen | 2026-08-17 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e68697061612e73656375726974795f6f6666696365723a6465 |
| ISMS scope defined and documented The scope of the Information Security Management System is documented, including boundaries and applicability, interfaces and dependencies, and any exclusions with justification. Reviewed at least annually and after significant organizational change. |
ISO27001 · Cl. 4.3 | NOT STARTED | — | — | — |
| Information security objectives set and measured Information security objectives are established at relevant functions and levels, are consistent with the security policy, are measurable where practical, and are monitored, communicated, and updated as appropriate. |
ISO27001 · Cl. 6.2 | NOT STARTED | — | — | — |
| Information security policy approved A formal information security policy has been reviewed and approved by management within the past 12 months. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
SOC2 · CC5.3 | COMPLIANT | Sarah Chen | 2026-08-18 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e676f7665726e616e63652e73656375726974795f706f6c6963 |
| Management information security oversight Management reviews and approves the information security program annually and accountability is assigned. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
SOC2 · CC1.1 | COMPLIANT | Sarah Chen | 2026-08-18 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e676f7665726e616e63652e626f6172645f6f76657273696768 |
| Management review of the ISMS completed Top management has reviewed the ISMS within the past 12 months, considering audit results, feedback, risk assessment results, achievement of objectives, and opportunities for improvement. Decisions and actions are documented. |
ISO27001 · Cl. 9.3 | NOT STARTED | — | — | — |
| Statement of Applicability documented A current Statement of Applicability lists every Annex A control, whether it is included or excluded, the justification for the decision, and whether it is implemented. Updated whenever the risk treatment plan or applied controls change. |
ISO27001 · Cl. 6.1.3 | NOT STARTED | — | — | — |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Annual security awareness training All employees have completed security awareness training in the current calendar year. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
SOC2 · CC1.4 | COMPLIANT | Sarah Chen | 2026-08-17 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e68722e73656375726974795f747261696e696e673a64656d6f |
| Background checks for new hires Pre-employment background checks are conducted for all employees with access to production systems. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
SOC2 · CC1.4 | COMPLIANT | Sarah Chen | 2026-08-17 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e68722e6261636b67726f756e645f636865636b733a64656d6f |
| PCI security awareness training (annual) Personnel with access to systems in scope for PCI DSS complete PCI-specific security awareness training at hire and at least annually thereafter. Training covers cardholder data handling, phishing, and role-specific responsibilities. Attendance and materials are retained. |
PCI · 12.6.1 | NOT STARTED | — | — | — |
| Workforce sanction policy documented A documented sanction policy applies appropriate consequences to workforce members who fail to comply with security policies and procedures. Application of sanctions is recorded when they occur. |
HIPAA · 164.308(a)(1)(ii)(C) | NOT STARTED | — | — | — |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Annual IR tabletop exercise An incident response tabletop exercise has been conducted in the current year and results have been documented. |
SOC2 · CC7.4 | NOT STARTED | — | — | — |
| Breach notification process documented A breach notification process is documented and tested, complying with applicable regulatory requirements. |
SOC2 · CC7.5 | NOT STARTED | — | — | — |
| Card-breach incident response playbook The incident response plan includes card-brand-specific breach notification steps: forensics firm on retainer, card-brand notification contacts (Visa/Mastercard/Amex/Discover), acquirer notification path, and evidence preservation procedures for CHD-related incidents. |
PCI · 12.10.1 | NOT STARTED | — | — | — |
| Incident response plan documented A formal incident response plan exists, has been approved by management, and is reviewed and updated annually. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
SOC2 · CC7.4 | COMPLIANT | Sarah Chen | 2026-08-16 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e696e636964656e742e69725f706c616e3a64656d6f |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Annual penetration test An annual penetration test has been completed by a qualified third party and critical findings have been remediated. |
SOC2 · CC7.1 | NOT STARTED | — | — | — |
| ISMS internal audit completed An internal audit of the ISMS has been conducted within the past 12 months against the requirements of ISO/IEC 27001 and the organization's own procedures. Findings are documented and tracked to closure. |
ISO27001 · Cl. 9.2 | NOT STARTED | — | — | — |
| Nonconformities and corrective actions tracked Nonconformities identified through audit, incident, or review are logged with root cause, corrective action, responsible owner, and closure evidence. The tracker is reviewed by management on a defined cadence. |
ISO27001 · Cl. 10.2 | NOT STARTED | — | — | — |
| Payment-page tamper detection evidence A change-detection mechanism is in place on all payment pages (including redirects to hosted Checkout) that alerts on unauthorized modification of headers, scripts, or content. Evidence of alert testing and any triaged alerts is retained. |
PCI · 11.6.1 | NOT STARTED | — | — | — |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Device and media controls documented Policies govern the receipt, movement, reuse, and disposal of hardware and electronic media containing ePHI: sanitization before reuse, destruction records for disposed media, accountability logs for media movement, and backup before equipment moves. |
HIPAA · 164.310(d)(1) | NOT STARTED | — | — | — |
| Facility access controls documented Policies and procedures limit physical access to systems containing ePHI and the facilities housing them (office, data-room, or the physical-access responsibilities delegated to a cloud or colocation provider), while ensuring authorized access is allowed. Contingency operations and facility security plans are addressed. |
HIPAA · 164.310(a)(1) | NOT STARTED | — | — | — |
| Media sanitized before disposal or reuse Information system media containing Federal Contract Information, paper and digital, is sanitized or destroyed before disposal or release for reuse, with a record of what was sanitized or destroyed, when, how, and by whom. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
CMMC · MP.L1-3.8.3 | COMPLIANT | Sarah Chen | 2026-07-03 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e636d6d632e6d656469615f646973706f73616c3a64656d6f |
| Physical access devices controlled Keys, badges, access cards, and other physical access devices for areas housing Federal Contract Information are inventoried, issued against named individuals, and recovered or deactivated when no longer needed. |
CMMC · PE.L1-3.10.5 | NOT STARTED | — | — | — |
| Visitors escorted and activity logged Visitors to facilities housing systems with Federal Contract Information are escorted, their activity is monitored, and physical access is logged. For fully cloud-hosted environments, the provider's physical-access responsibility and any office areas where FCI is handled are both addressed. |
CMMC · PE.L1-3.10.3 | NOT STARTED | — | — | — |
| Workstation use and security policy Policies specify the proper functions, manner of use, and physical safeguards for workstations that can access ePHI: screen locking, disk encryption on laptops, clean-desk expectations for PHI, and restrictions on public or shared devices. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
HIPAA · 164.310(b) | COMPLIANT | Sarah Chen | 2026-08-17 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e68697061612e776f726b73746174696f6e5f73656375726974 |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Annual risk assessment completed An information security risk assessment covering the in-scope environment has been completed in the current year. |
SOC2 · CC3.1 | NOT STARTED | — | — | — |
| Fraud risk assessment Fraud risks have been identified and controls are in place and monitored to mitigate them. |
SOC2 · CC3.3 | NOT STARTED | — | — | — |
| Risk treatment plan approved A risk treatment plan is documented showing selected treatment options, necessary controls (from Annex A and elsewhere), residual risk, and risk-owner approvals. Reviewed after the annual risk assessment or upon significant change. |
ISO27001 · Cl. 6.1.3 | NOT STARTED | — | — | — |
| ePHI-scoped risk analysis completed An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI has been completed, is documented, and is updated when the environment or threat landscape changes materially. Scope explicitly identifies where ePHI is created, received, maintained, and transmitted. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
HIPAA · 164.308(a)(1)(ii)(A) | COMPLIANT | Sarah Chen | 2026-08-17 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e68697061612e7269736b5f616e616c797369733a64656d6f |
| Control | Framework | Status | Owner | Attested | Timestamp |
|---|---|---|---|---|---|
| Annual vendor security review All vendors with access to production data or systems have been assessed for security controls annually. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
SOC2 · CC9.2 | COMPLIANT | Sarah Chen | 2026-08-03 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e76656e646f722e616e6e75616c5f7265766965773a64656d6f |
| Business associate inventory maintained A current inventory lists every business associate and subcontractor that creates, receives, maintains, or transmits ePHI on the organization's behalf, with the BAA status and date for each. Reviewed at least annually. Note: Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes. |
HIPAA · 164.308(b)(1) | COMPLIANT | Sarah Chen | 2026-08-17 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA SHA-256: 6d616e75616c2e68697061612e6261615f696e76656e746f72793a64656d6f |
| Third-party service provider (TPSP) list A maintained list of all TPSPs with which cardholder data is shared or that could affect the security of the CDE (payment processor, cloud host, ASV, WAF, tag manager) including each party's PCI DSS AoC status and responsibility matrix. |
PCI · 12.8.1 | NOT STARTED | — | — | — |
| Vendor DPAs / BAAs in place Data Processing Agreements or Business Associate Agreements are signed with all vendors handling customer or sensitive data. |
SOC2 · CC9.2 | NOT STARTED | — | — | — |
| Written PCI responsibility agreements with TPSPs Signed written agreements are in place with each TPSP in scope that explicitly acknowledge which PCI DSS requirements they are responsible for on your behalf. |
PCI · 12.8.2 | NOT STARTED | — | — | — |
| Policy | Category | Status | Owner | Adopted | Timestamp |
|---|---|---|---|---|---|
| Access Control Policy | Access Management | ADOPTED | Marcus Webb | 2026-01-12 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA |
| Business Continuity and DR Policy | Business Continuity | ADOPTED | Sarah Chen | 2026-03-28 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA |
| Information Security Policy | Governance | ADOPTED | Sarah Chen | 2025-12-29 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA |
| Acceptable Use Policy | HR & Training | ADOPTED | Sarah Chen | 2026-01-05 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA |
| Incident Response Policy | Incident Response | ADOPTED | Marcus Webb | 2026-02-09 | DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA |
| PHI Handling and Breach Notification Policy | Incident Response | DRAFT | — | — | — |
| Vendor Management Policy | Vendor Management | DRAFT | Sarah Chen | — | — |