SOC 2 Control Implementation Map

SOC 2 Control → Implementation Map

The missing translation layer between SOC 2's abstract Trust Services Criteria

and the concrete engineering controls an auditor will accept as evidence.

When someone (or an agent) asks "what do we actually build to satisfy CC6.1?",

this maps each common criterion to specific, implementable controls and the

evidence that proves them.

Not legal advice and not a substitute for your auditor. This is an engineering

reference to accelerate readiness and reduce back-and-forth, based on the

controls auditors commonly accept.

What's inside

• controls/access-control.md (CC6.x) — logical access, MFA, least privilege,

provisioning/deprovisioning, key management.

• controls/change-management.md (CC8.x) — SDLC, code review, CI/CD gates,

separation of duties, IaC.

• controls/monitoring.md (CC7.x) — logging, alerting, vulnerability management,

incident response.

• controls/availability.md (A1.x) — backups, DR, capacity, SLAs.
• EVIDENCE-INDEX.md — for each control, the artifact an auditor wants to see and

where it typically comes from.

Format

Each control is listed as:

Criterion (id) → What it means → Concrete controls to implement →

Evidence to collect

So you can go straight from "CC6.1" to "here's the config + the screenshot/export

the auditor will ask for."

Who this is for

Startups heading into their first SOC 2, engineers assigned "make us compliant",

and agents assembling a readiness checklist that must be specific, not hand-wavy.

Requirements

None.

License

MIT. Adapt into your compliance wiki.