SOC 2: Trust Services

Azure 48 automated checks

Audit readiness checks aligned with Trust Services Criteria (2017), covering Security, Availability, Processing Integrity, Confidentiality, and Common Criteria

Availability (A1)

Organization should maintain capacity and availability planning A1.2 · Medium

Availability: Data Recovery (A1)

Key Vault must enable soft delete A1.2 · High

Availability: Disaster Recovery (A1)

IAM password policy must require minimum length of 14 A1.2 · Medium

Availability: Monitoring (A1)

IAM password policy must require minimum length of 14 A1.1 · Medium

Change Management (CC8)

Organization should have a formal change management process CC8.1 · Medium
Organization should maintain formal change management procedures CC8.1 · High

Common Criteria: Communication & Information (CC2)

IAM password policy must require minimum length of 14 CC2.1 · Medium

Common Criteria: Control Activities (CC5)

IAM password policy must require minimum length of 14 CC5.1 · Medium

Common Criteria: Control Environment (CC1)

IAM password policy must require minimum length of 14 CC1.1 · Medium
IAM password policy must require minimum length of 14 CC1.2 · Medium

Common Criteria: Monitoring Activities (CC4)

IAM password policy must require minimum length of 14 CC4.1 · Medium

Common Criteria: Risk Assessment (CC3)

IAM password policy must require minimum length of 14 CC3.1 · Medium

Communication (CC2)

Organization should communicate security responsibilities to all personnel CC2.1 · Medium
Organization should have processes for external security communications CC2.3 · Medium

Confidentiality (C1)

Organization should classify data by confidentiality level C1.1 · Medium
Organization should have secure data disposal procedures C1.2 · Medium

Confidentiality: Data Classification (C1)

IAM password policy must require minimum length of 14 C1.1 · Medium

Confidentiality: Network Isolation (C1)

Cosmos DB should disable public network access C1.2 · High

Control Activities (CC5)

Organization should maintain logical access policies and procedures CC5.2 · High

Control Environment (CC1)

Organization should conduct security awareness training CC1.4 · Medium
Organization should define governance structure and oversight responsibilities CC1.1 · High
Organization should maintain a code of conduct and ethics policy CC1.4 · Medium
Organization should perform background checks for security-relevant roles CC1.4 · High
Organization should maintain documented information security policies CC1.2 · High

Logical and Physical Access (CC6)

Organization should perform periodic access reviews CC6.2 · High

Monitoring (CC4)

Organization should monitor and remediate control deficiencies CC4.2 · High

Processing Integrity: Authentication (PI1)

App Service must use managed identity for automatic logoff and credential management PI1.4 · High

Processing Integrity: Data Validation (PI1)

IAM password policy must require minimum length of 14 PI1.1 · Medium

Risk Assessment (CC3)

Organization should conduct formal risk assessments CC3.1 · High
Organization should define risk appetite and tolerance levels CC3.2 · Medium

Risk Assessment (CC4)

Organization should conduct periodic risk assessments CC4.1 · High

Risk Mitigation (CC9)

Organization should assess third-party vendor security CC9.2 · Medium
Organization should assess and monitor third-party vendor risks CC9.2 · Medium

Security: Access Control (CC6)

Storage account must disable anonymous blob public access CC6.3 · Critical
Key Vault should use RBAC authorization CC6.3 · Medium
SQL Server should use Azure AD-only authentication CC6.1 · High
App Service must disable FTP or require FTPS only CC6.6 · High

Security: Data Protection (CC6)

Key Vault must enable purge protection CC6.1 · High

Security: Encryption (CC6)

Storage account blob encryption must be enabled CC6.1 · Critical
Storage account must enforce HTTPS transfer CC6.1 · High
App Service must enforce HTTPS only CC6.1 · High

Security: Monitoring (CC7)

Key Vault should have diagnostic logging enabled CC7.2 · High

Security: Network Security (CC6)

SQL Server should disable public network access CC6.6 · High

Security: Vulnerability Management (CC7)

Virtual Machine must enable encryption at host CC7.1 · High
IAM password policy must require minimum length of 14 CC7.1 · Medium

System Operations (CC7)

Organization should have a documented incident response plan CC7.4 · High
Organization should have a business continuity and disaster recovery plan CC7.5 · High
Organization should monitor system operations and detect anomalies CC7.2 · High

Measure your SOC 2: Trust Services posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation