# SOC 2 ↔ ISO/IEC 27001 — Statement of Applicability crosswalk

**Status: engineering crosswalk stub — not a Statement of Applicability, not an ISMS, not a certification.**

EdgeCMS joins the [SOC 2 control checklist](soc2-control-checklist.md) (Trust Services Criteria **CC1–CC9**) to the [ISO 27001 Annex A evidence map](iso-27001-controls.md) so a host can draft a real SoA and risk register (`CMP-02`). This file is a **starting matrix**, not a finished host document and not an audit report (`SAAS-PRD.md` `SP-07` / D7).

Related: `CMP-01`–`CMP-18`, `HS-11`, `HS-12`, `OPS-02`. Code pointers for Annex A live in `apps/api/src/compliance/iso27001/`.

## How to read this table

| Column | Meaning |
| --- | --- |
| **SOC 2** | AICPA TSC Common Criteria series |
| **ISO Annex A** | Primary ISO/IEC 27001:2022 Annex A controls for that theme |
| **Applicability** | Draft SoA hint for EdgeCMS Cloud product scope (host must confirm) |
| **Evidence today** | What the product/repo already exposes |
| **Host SoA gap** | What still belongs in the host ISMS before examination |

### Applicability vocabulary

| Value | Meaning |
| --- | --- |
| `applicable` | In product scope; expect engineering evidence plus host procedure |
| `partial` | Some evidence exists; residual risk / justification still required |
| `host_isms` | Host decides include/exclude with written rationale |
| `out_of_scope` | Not claimed for this product slice |

Never treat `applicable` or `partial` as “certified”, “compliant”, or “SoA complete”.

## Crosswalk

| SOC 2 | Theme | ISO Annex A (primary) | Applicability | Evidence today | Host SoA gap |
| --- | --- | --- | --- | --- | --- |
| **CC1** | Control environment | A.5.1, A.5.2, A.5.4 | `host_isms` | Named operators (`SUPER_ADMIN_EMAILS`); legal stubs under `apps/website/legal/` | Yearly policy set (`CMP-01`); oversight; staff agreements (`CMP-17`) |
| **CC2** | Communication & information | A.5.1, A.6.3 | `partial` | Public docs; website standards ledger tagged Planned / In progress | Dated customer trust page (`CMP-18`); internal control-change communications |
| **CC3** | Risk assessment | A.5.9 (+ risk treatment via privileged-access / inventory themes) | `partial` | This crosswalk; PRD §4.8 risk notes; `abac.denied` audit events | Living risk register + **quarterly SoA review** (`CMP-02`) |
| **CC4** | Monitoring | A.8.15, A.8.16 | `applicable` | `GET .../audit/export`, `/verify`, `/completeness`; optional `AUDIT_SIEM_*` | Continuous monitoring runbooks; alert SLAs; management review of findings |
| **CC5** | Control activities | A.5.15–A.5.18, A.8.2, A.8.3, A.8.5 | `applicable` | RBAC + ABAC; MFA flags; CSRF; rate limits; security headers — see [Auth and access](auth-and-access.md) | Ops-owned control matrix; documented exception handling |
| **CC6** | Logical access | A.5.15–A.5.18, A.8.2, A.8.3, A.8.5 | `applicable` | Access-review stub: `GET .../compliance/access-review`; membership roles; MFA (`HS-11`) | Quarterly acknowledgement; joiner/mover/leaver tickets; 1-day offboarding proof (`CMP-04`) |
| **CC7** | System operations | A.8.15, A.8.16 (+ host backup / BC controls) | `partial` | Health routes; audit retention ≥ 365 days; [Operations and security](operations-security.md) | Stated RPO/RTO; restore drills; incident runbook with 72h breach path (`CMP-09`, `CMP-10`) |
| **CC8** | Change management | A.8.9, A.8.32 | `applicable` | Reviewed PRs + CI + tagged deploys (`OPS-02`); `host.changeControlSink`; `GET .../compliance/change-log`; root `CHANGELOG.md` | Emergency-change after-action; consistent ticket↔deploy linkage (`CMP-06`) |
| **CC9** | Risk mitigation | A.5.19, A.5.21, A.5.23 | `partial` | Supplier/deps note; Cloudflare-only year-one posture; Stripe SAQ A intent; [Supply chain](supply-chain.md) | Yearly vendor security reviews (`CMP-14`); pen-test cadence (`CMP-08`) |

### Theme → Annex A (same focus as the ISO map)

| Theme | Controls | Product anchors |
| --- | --- | --- |
| Access control | A.5.15–A.5.18, A.8.2, A.8.3, A.8.5 | RBAC, ABAC, MFA, tenant isolation (`HS-01`, `HS-11`, `PL-03`) |
| Logging / monitoring | A.8.15, A.8.16 | Hash-chained audit ledger, SIEM hooks (`HS-12`, `CMP-05`) |
| Change / config | A.8.9, A.8.32 | wrangler.toml, CI/deploy, `changeControlSink` (`CMP-06`) |
| Asset inventory | A.5.9 | `buildAssetInventoryStub()` (`completeness: "stub"`) |
| Supplier / cloud | A.5.19, A.5.21, A.5.23 | Supplier note + lockfile; SBOM track separate |

Full Annex A pointer list and gaps: `apps/api/src/compliance/iso27001/controls.ts`. Verify paths with `bun scripts/iso27001-evidence.ts`.

## Draft SoA workflow for hosts

1. Copy this matrix into the host ISMS SoA template (control id, applicable Y/N, implementation status, owner, evidence link, residual risk).
2. For each `applicable` / `partial` row, attach EdgeCMS evidence exports **and** host procedure artefacts (tickets, reviews, drill receipts).
3. For each `host_isms` / `out_of_scope` row, write an exclusion justification or expand scope deliberately.
4. Review quarterly with the risk register (`CMP-02`). Do not mark website standards “audited” until an independent report has a date.

## Explicit non-claims

- No SOC 2 Type I/II report, ISO 27001 certificate, surveillance audit, or accredited certification body engagement is asserted here.
- No completed host Statement of Applicability or risk register ships in this repository — only this crosswalk stub.
- No production backup, penetration-test, or remote performance proof is claimed by this document.
- Staff security training, background checks, and physical controls remain out of product scope (`CMP-17`).

## What not to say

- Do not write “SOC 2 certified”, “ISO 27001 certified”, “SOC/ISO compliant”, “we passed SOC 2”, or “SoA approved”.
- Prefer: “We maintain a SOC 2 ↔ ISO Annex A SoA crosswalk and exportable engineering evidence; host SoA and examination are planned.”
- Website build tests already fail on certification language (`SP-07`).

## Related guides

- [SOC 2 control checklist](soc2-control-checklist.md)
- [ISO 27001 Annex A evidence](iso-27001-controls.md)
- [Auth and access](auth-and-access.md)
- [Operations and security](operations-security.md)
- [Hosting seams](hosting-seams.md)
- [Supply chain](supply-chain.md)
- SaaS compliance track: `SAAS-PRD.md` §4.8