Documentation
¶
Overview ¶
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, the manual-evidence policies, and the handful of Go rules for checks the DSL cannot express (CloudWatch metric-filter substring matching).
Policies are authored as Go values via the compact builders in this file. Most automated checks reduce to "every / no / some record in a slot satisfies a field condition" — exactly what the pass_when DSL expresses without a line of Go. The escape-hatch rules live in rules.go.
Many policies reference evidence types whose source plugins are not yet registered (firewall_rule, password_policy, cloudwatch_alarm, …). Those policies plan cleanly and are skipped at evaluation until a matching source is configured — the deferred-source model. See docs/claude/implementation-plan-policy-library.md.
Index ¶
Constants ¶
const FrameworkID = "soc2"
FrameworkID is the registered identifier.
const FrameworkVersion = "soc2-2017@1.0.0"
FrameworkVersion stamps every PolicyRef returned by this framework.
Variables ¶
This section is empty.
Functions ¶
func Controls ¶
Controls returns the SOC 2 (TSC 2017) control catalog: the common criteria (CC1–CC9) plus the Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P-series) categories referenced by the policy library.
func ManualCatalog ¶
func ManualCatalog() map[string]manual.CatalogEntry
ManualCatalog returns one catalog entry per manual policy. The catalog ID equals each manual policy's CatalogEntry; cadence and grace period follow the policy's declared cadence.
func Policies ¶
Policies returns the full SOC 2 policy library: automated checks (pass_when + rule: escape hatches) and manual-evidence policies.
Source Files