SOC 2: Trust Services

AWS 46 automated checks

Audit readiness checks aligned with Trust Services Criteria (2017), covering Security, Availability, Processing Integrity, Confidentiality, and Common Criteria for AWS resources

Availability (A1)

Organization should maintain capacity and availability planning A1.2 · Medium

Availability: Data Recovery (A1)

RDS cluster backup retention should be at least 14 days A1.2 · Medium
DynamoDB table must have point-in-time recovery enabled A1.2 · High

Availability: Disaster Recovery (A1)

RDS instance must have Multi-AZ enabled A1.2 · High

Availability: Monitoring (A1)

IAM password policy must require minimum length of 14 A1.1 · Medium

Change Management (CC8)

Organization should maintain formal change management procedures CC8.1 · High

Common Criteria: Communication & Information (CC2)

IAM password policy must require minimum length of 14 CC2.1 · Medium

Common Criteria: Control Activities (CC5)

IAM password policy must require minimum length of 14 CC5.1 · Medium

Common Criteria: Control Environment (CC1)

IAM password policy must require minimum length of 14 CC1.1 · Medium
IAM password policy must require minimum length of 14 CC1.2 · Medium

Common Criteria: Monitoring Activities (CC4)

IAM password policy must require minimum length of 14 CC4.1 · Medium

Common Criteria: Risk Assessment (CC3)

IAM password policy must require minimum length of 14 CC3.1 · Medium

Communication (CC2)

Organization should communicate security responsibilities to all personnel CC2.1 · Medium
Organization should have processes for external security communications CC2.3 · Medium

Confidentiality (C1)

Organization should classify data by confidentiality level C1.1 · Medium
Organization should have secure data disposal procedures C1.2 · Medium

Confidentiality: Data Classification (C1)

IAM password policy must require minimum length of 14 C1.1 · Medium

Confidentiality: Key Management (C1)

KMS key must have automatic key rotation enabled C1.1 · High

Confidentiality: Network Isolation (C1)

Redshift cluster must not be publicly accessible C1.2 · Critical

Control Activities (CC5)

Organization should maintain logical access policies and procedures CC5.2 · High

Control Environment (CC1)

Organization should define governance structure and oversight responsibilities CC1.1 · High
Organization should maintain a code of conduct and ethics policy CC1.4 · Medium
Organization should perform background checks for security-relevant roles CC1.4 · High
Organization should maintain documented information security policies CC1.2 · High

Monitoring (CC4)

Organization should monitor and remediate control deficiencies CC4.2 · High

Processing Integrity: Authentication (PI1)

Cognito user pool must enforce MFA PI1.4 · Critical

Processing Integrity: Data Validation (PI1)

IAM password policy must require minimum length of 14 PI1.1 · Medium

Risk Assessment (CC3)

Organization should conduct formal risk assessments CC3.1 · High
Organization should define risk appetite and tolerance levels CC3.2 · Medium

Risk Mitigation (CC9)

Organization should assess and monitor third-party vendor risks CC9.2 · Medium

Security: Access Control (CC6)

IAM root user must not have access keys CC6.3 · Critical
IAM user must have MFA enabled CC6.3 · Critical
IAM group should be used for permission management CC6.3 · Low

Security: Data Protection (CC6)

S3 bucket must block all public access CC6.6 · Critical

Security: Encryption (CC6)

S3 bucket encryption should use SSE-KMS with a customer-managed key CC6.1 · Medium
RDS instance must have storage encryption enabled CC6.1 · High
EBS volume must be encrypted CC6.1 · High
Load balancer listener must use a secure SSL policy CC6.1 · High

Security: Monitoring (CC7)

CloudTrail trail must be multi-region CC7.2 · Critical
GuardDuty detector must be enabled CC7.2 · Critical
AWS Config must record all supported resource types CC7.2 · High

Security: Network Security (CC6)

Security group must not allow unrestricted ingress (0.0.0.0/0) CC6.6 · Critical
RDS instance must not be publicly accessible CC6.6 · Critical

Security: Vulnerability Management (CC7)

Lambda function must not use a deprecated runtime CC7.1 · High
Inspector coverage must be active CC7.1 · Medium

System Operations (CC7)

Organization should monitor system operations and detect anomalies CC7.2 · High

Measure your SOC 2: Trust Services posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation