SOC 2 criteria matrix
Every Trust Services Criterion in scope (Security, which is the CC series, plus Availability and
Confidentiality), the control that answers it, and where that stands. Checked against the AICPA's
2017 Trust Services Criteria (revised points of focus, 2022) on 28 Oct 2026, not only against
Kyle's roadmap, and again on 29 Oct point of focus by point of focus against the AICPA's own text
(see Sources at the foot), which added TS-10 to TS-16. Where the roadmap had no item for a criterion, a new item was added to the
readiness page under "Found against the criteria" (TS-1 onwards).
The boundary is the Lucent Axis accounts only (Dan, 28 Oct); Dan's personal GitHub, Vercel and
Supabase, where Paul's demo runs, are outside it.
Without a compliance platform (see Free first in README.md) this file is the control
list the auditor walks through, and control-calendar.md is how each
recurring control leaves its evidence.
Status: In place (working today, evidence exists), Built (in the code, evidence not yet
collected), Drafted (policy or plan written, not yet adopted or signed), Partial (some of it running), Gap (nothing yet).
CC1 Control environment
| Criterion |
Control |
Status |
Items |
| CC1.1 Integrity and ethical values |
Code of conduct in the information security policy, signed on joining and yearly |
Drafted |
TS-1, ORG-14 |
| CC1.2 Oversight by those in charge |
Quarterly security review by the owners, minutes kept |
Drafted (calendar) |
TS-2 |
| CC1.3 Structure, reporting lines, responsibilities |
Roles named in the information security policy (security owner, platform owner, app owner) |
Drafted |
TS-1 |
| CC1.4 Competence: hiring, training |
Background checks, security training on joining and yearly |
Drafted |
ORG-13, ORG-14 |
| CC1.5 Accountability |
Policies signed; responsibilities in each person's role |
Drafted |
ORG-14 |
| Criterion |
Control |
Status |
Items |
| CC2.1 Quality information for control |
System inventory, data flows, this matrix |
Drafted |
OW-7, ORG-10 |
| CC2.2 Internal communication |
Policies published in the repo and on the hub, signed; incident contacts in the IR plan; a route for concerns that goes around the person they are about |
Drafted; route a gap |
ORG-14, LM-3, TS-10 |
| CC2.3 External communication |
Security contact and disclosure route published (security.txt); commitments in the contract and DPA; subprocessor list |
Gap |
TS-3, VN-3, VN-5 |
CC3 Risk assessment
| Criterion |
Control |
Status |
Items |
| CC3.1 Objectives specified |
Service commitments in the system description |
Drafted |
ORG-10 |
| CC3.2 Risks identified and analysed |
Risk register, reviewed quarterly |
Drafted |
ORG-17 |
| CC3.3 Fraud risk |
Fraud and insider risks in the register (a person editing their own records, a forged sign-off) |
Drafted |
TS-5 |
| CC3.4 Changes that affect controls |
New client, new subprocessor or new add-on triggers a register review |
Drafted (calendar) |
TS-5 |
CC4 Monitoring activities
| Criterion |
Control |
Status |
Items |
| CC4.1 Ongoing and separate evaluations |
Control calendar with an evidence log; CI on every change; a yearly automated scan, a third-party pen test before the first enterprise client |
Drafted |
TS-4, LM-4 |
| CC4.2 Deficiencies communicated and fixed |
Quarterly review records each missed control and its fix |
Drafted (calendar) |
TS-2, TS-4 |
CC5 Control activities
| Criterion |
Control |
Status |
Items |
| CC5.1 Controls chosen to cut risk |
This matrix, tied to the risk register; segregation of duties stated, with its compensating controls |
Drafted; SoD stated in the change-management policy, R16 awaiting acceptance |
ORG-17, TS-11 |
| CC5.2 Technology general controls |
Access, change, backup and monitoring controls below |
See CC6 to CC8 |
|
| CC5.3 Policies and procedures deployed |
Policy set, signed; the calendar shows each one operating |
Drafted |
ORG-09, TS-4 |
CC6 Logical and physical access
| Criterion |
Control |
Status |
Items |
| CC6.1 Access security: identity, encryption, inventory |
RLS on every public table (verify_rls.sql), nothing callable or writable signed out (verify_anon.sql; its migrations applied and passing on the Lucent Axis database, 28 Oct), MFA on every company account, private buckets with signed URLs, TLS everywhere, encryption at rest by Supabase |
Partly in place |
DB-1, DB-2, SC-4, ORG-06, ST-2, VE-5, TS-12 |
| CC6.2 Granting access |
Joining checklist; app roles set by link_user.sh |
Drafted |
ORG-19, TS-12 |
| CC6.3 Removing and reviewing access |
Leaving checklist (24 hours), quarterly access review with a script that lists every account |
Built (script) |
ORG-20, ID-4, TS-12 |
| CC6.4 Physical access |
Carved out to Supabase (AWS) and Vercel data centres; their SOC 2 reports reviewed yearly |
Drafted |
TS-8, VN-1 |
| CC6.5 Disposal of data and devices |
Retention and disposal policy; laptops wiped at leaving |
Drafted |
TS-6, DB-6 |
| CC6.6 Threats from outside the boundary |
Security headers and a Content-Security-Policy (report-only, proved on 17 screens), Vercel firewall, API reachable only through RLS |
Built (headers, CSP report-only) |
VE-5, NP-1 |
| CC6.7 Data in transit and removable media |
TLS only (HSTS), no data on removable media (BYOD policy) |
Built |
VE-5, ORG-16 |
| CC6.8 Malicious software |
Laptop malware protection (BYOD policy); uploads limited by type and size, photo location stripped |
Built (uploads); drafted (laptops) |
TS-7, ST-3 |
CC7 System operations
| Criterion |
Control |
Status |
Items |
| CC7.1 Vulnerabilities and configuration |
Dependabot alerts (on since 28 Oct), gitleaks, code scanning, RLS and audit-column checks, a security-settings baseline read back monthly (security-baseline.md) |
Partly in place |
SC-3, SC-7, SC-4, TS-13 |
| CC7.2 Monitoring for anomalies |
Uptime check on /api/health, a monthly review of app logins (app_access.sql) and sign-in failures, logs kept 12 months |
Partly built |
AV-4, LM-1, LM-2 |
| CC7.3 Evaluating security events |
Severity levels in the IR plan |
Drafted |
LM-3 |
| CC7.4 Responding to incidents |
IR plan, tabletop yearly |
Drafted |
LM-3, ORG-25 |
| CC7.5 Recovering from incidents |
Restore from the daily backup (PITR if bought), lessons-learned record |
Drafted |
AV-1, ORG-23, TS-14 |
CC8 Change management
| Criterion |
Control |
Status |
Items |
| CC8.1 Changes authorised, tested, approved |
PR with required checks on lucent-axis/scope, PR template recording risk, testing, the rollback and the availability impact (TS-16), a written segregation-of-duties paragraph (TS-11), a configuration baseline read back monthly (TS-13), monthly review of merged PRs, migrations through CI, a log of dashboard changes |
Partly built |
SC-5, SC-6, ORG-07, TS-9, TS-11, TS-13, TS-16 |
CC9 Risk mitigation
| Criterion |
Control |
Status |
Items |
| CC9.1 Business disruption |
BC/DR plan, cyber insurance |
Drafted |
ORG-24, ORG-31 |
| CC9.2 Vendors and partners |
Subprocessor list, yearly report review, CUECs |
Drafted |
VN-1 to VN-3, ORG-18, TS-15 |
Availability
| Criterion |
Control |
Status |
Items |
| A1.1 Capacity |
Supabase usage alerts, reporting off production; until then a monthly capacity look |
Partial (monthly capacity look, AV-5) |
AV-5 |
| A1.2 Environmental protections, backups, recovery infrastructure |
Daily backups (Supabase; PITR off, read 28 Oct), carved-out data centres |
Waits on the PITR decision (AV-2) and the first restore test |
AV-1, AV-2, TS-14, TS-15 |
| A1.3 Recovery plan tested |
Restore test record, yearly DR drill |
Drafted |
ORG-23, AV-3 |
Confidentiality
| Criterion |
Control |
Status |
Items |
| C1.1 Confidential information identified and protected |
Data classification naming the Confidential columns; column limits for drivers |
Drafted (classification) |
DB-5, DB-2 |
| C1.2 Confidential information disposed of |
Retention schedule, deletion at contract end, legal hold |
Drafted (policy) |
DB-6, TS-6 |
Sources
- The criteria and their points of focus: AICPA, TSP section 100, 2017 Trust Services
Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy. Read
29 Oct in the AICPA's own published text, the edition with the March 2020 conforming changes
(a copy circulating publicly; the criteria are identical in every edition since 2017).
- The 2022 revised points of focus: AICPA, the same document with Revised Points of Focus,
2022, at aicpa-cima.com.
A free download, but behind a free AICPA account, so not yet read in full here. The changes
were taken from EY's summary of the revision (To the Point, 2 Nov 2022):
data flow, asset location and classification under CC2.1; threats, vulnerabilities and residual
risk under CC3.2; system, service and vendor accounts and recovering laptops under CC6;
patching and resilience under CC8.1; threats to data recoverability under A1.2. To do:
someone with an AICPA account downloads it into
docs/compliance/reference/ and the 29 Oct
pass is re-read against it.
- The system description: AICPA, DC section 200, 2018 Description Criteria with revised
implementation guidance (2022), at aicpa-cima.com.
- Coming next: the AICPA exposed proposed 2027 Trust Services Criteria and Description
Criteria for comment on 26 Oct 2026 (exposure drafts).
Drafts only: a Type I in early 2027 is examined against the 2017 criteria. Read the redline once
it is downloaded, because the Type II window may straddle the change.