Docs / Reference
SOC 2 ↔ ISO SoA
Status: engineering crosswalk stub — not a Statement of Applicability, not an ISMS, not a certification.
EdgeCMS joins the SOC 2 control checklist (Trust Services Criteria CC1–CC9) to the ISO 27001 Annex A evidence map so a host can draft a real SoA and risk register (CMP-02). This file is a starting matrix, not a finished host document and not an audit report (SAAS-PRD.md SP-07 / D7).
Related: CMP-01–CMP-18, HS-11, HS-12, OPS-02. Code pointers for Annex A live in apps/api/src/compliance/iso27001/.
How to read this table
| Column | Meaning |
|---|---|
| SOC 2 | AICPA TSC Common Criteria series |
| ISO Annex A | Primary ISO/IEC 27001:2022 Annex A controls for that theme |
| Applicability | Draft SoA hint for EdgeCMS Cloud product scope (host must confirm) |
| Evidence today | What the product/repo already exposes |
| Host SoA gap | What still belongs in the host ISMS before examination |
Applicability vocabulary
| Value | Meaning |
|---|---|
applicable | In product scope; expect engineering evidence plus host procedure |
partial | Some evidence exists; residual risk / justification still required |
host_isms | Host decides include/exclude with written rationale |
out_of_scope | Not claimed for this product slice |
Never treat applicable or partial as “certified”, “compliant”, or “SoA complete”.
Crosswalk
| SOC 2 | Theme | ISO Annex A (primary) | Applicability | Evidence today | Host SoA gap |
|---|---|---|---|---|---|
| CC1 | Control environment | A.5.1, A.5.2, A.5.4 | host_isms | Named operators (SUPER_ADMIN_EMAILS); legal stubs under apps/website/legal/ | Yearly policy set (CMP-01); oversight; staff agreements (CMP-17) |
| CC2 | Communication & information | A.5.1, A.6.3 | partial | Public docs; website standards ledger tagged Planned / In progress | Dated customer trust page (CMP-18); internal control-change communications |
| CC3 | Risk assessment | A.5.9 (+ risk treatment via privileged-access / inventory themes) | partial | This crosswalk; PRD §4.8 risk notes; abac.denied audit events | Living risk register + quarterly SoA review (CMP-02) |
| CC4 | Monitoring | A.8.15, A.8.16 | applicable | GET .../audit/export, /verify, /completeness; optional AUDIT_SIEM_* | Continuous monitoring runbooks; alert SLAs; management review of findings |
| CC5 | Control activities | A.5.15–A.5.18, A.8.2, A.8.3, A.8.5 | applicable | RBAC + ABAC; MFA flags; CSRF; rate limits; security headers — see Auth and access | Ops-owned control matrix; documented exception handling |
| CC6 | Logical access | A.5.15–A.5.18, A.8.2, A.8.3, A.8.5 | applicable | Access-review stub: GET .../compliance/access-review; membership roles; MFA (HS-11) | Quarterly acknowledgement; joiner/mover/leaver tickets; 1-day offboarding proof (CMP-04) |
| CC7 | System operations | A.8.15, A.8.16 (+ host backup / BC controls) | partial | Health routes; audit retention ≥ 365 days; Operations and security | Stated RPO/RTO; restore drills; incident runbook with 72h breach path (CMP-09, CMP-10) |
| CC8 | Change management | A.8.9, A.8.32 | applicable | Reviewed PRs + CI + tagged deploys (OPS-02); host.changeControlSink; GET .../compliance/change-log; root CHANGELOG.md | Emergency-change after-action; consistent ticket↔deploy linkage (CMP-06) |
| CC9 | Risk mitigation | A.5.19, A.5.21, A.5.23 | partial | Supplier/deps note; Cloudflare-only year-one posture; Stripe SAQ A intent; Supply chain | Yearly vendor security reviews (CMP-14); pen-test cadence (CMP-08) |
Theme → Annex A (same focus as the ISO map)
| Theme | Controls | Product anchors |
|---|---|---|
| Access control | A.5.15–A.5.18, A.8.2, A.8.3, A.8.5 | RBAC, ABAC, MFA, tenant isolation (HS-01, HS-11, PL-03) |
| Logging / monitoring | A.8.15, A.8.16 | Hash-chained audit ledger, SIEM hooks (HS-12, CMP-05) |
| Change / config | A.8.9, A.8.32 | wrangler.toml, CI/deploy, changeControlSink (CMP-06) |
| Asset inventory | A.5.9 | buildAssetInventoryStub() (completeness: "stub") |
| Supplier / cloud | A.5.19, A.5.21, A.5.23 | Supplier note + lockfile; SBOM track separate |
Full Annex A pointer list and gaps: apps/api/src/compliance/iso27001/controls.ts. Verify paths with bun scripts/iso27001-evidence.ts.
Draft SoA workflow for hosts
- Copy this matrix into the host ISMS SoA template (control id, applicable Y/N, implementation status, owner, evidence link, residual risk).
- For each
applicable/partialrow, attach EdgeCMS evidence exports and host procedure artefacts (tickets, reviews, drill receipts). - For each
host_isms/out_of_scoperow, write an exclusion justification or expand scope deliberately. - Review quarterly with the risk register (
CMP-02). Do not mark website standards “audited” until an independent report has a date.
Explicit non-claims
- No SOC 2 Type I/II report, ISO 27001 certificate, surveillance audit, or accredited certification body engagement is asserted here.
- No completed host Statement of Applicability or risk register ships in this repository — only this crosswalk stub.
- No production backup, penetration-test, or remote performance proof is claimed by this document.
- Staff security training, background checks, and physical controls remain out of product scope (
CMP-17).
What not to say
- Do not write “SOC 2 certified”, “ISO 27001 certified”, “SOC/ISO compliant”, “we passed SOC 2”, or “SoA approved”.
- Prefer: “We maintain a SOC 2 ↔ ISO Annex A SoA crosswalk and exportable engineering evidence; host SoA and examination are planned.”
- Website build tests already fail on certification language (
SP-07).
Related guides
- SOC 2 control checklist
- ISO 27001 Annex A evidence
- Auth and access
- Operations and security
- Hosting seams
- Supply chain
- SaaS compliance track:
SAAS-PRD.md§4.8