Documentation
¶
Overview ¶
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, and the manual-evidence policies. Every shipped policy is pass_when: or manual — Rules() returns nil (no rule: escape hatch is used today; the infrastructure remains available for a future check the DSL cannot express).
Policies are authored as Go values via the compact builders in this file. Most automated checks reduce to "every / no / some record in a slot satisfies a field condition" — exactly what the pass_when DSL expresses without a line of Go.
Every evidence type a shipped policy accepts has a registered emitter (enforced at build time by internal/sources/builtin/coverage_test.go), so there are no inert "deferred-source" policies in-tree. A new evidence type added ahead of its source must ship a source in the same change or the coverage test fails.
Index ¶
Constants ¶
const FrameworkID = "soc2"
FrameworkID is the registered identifier.
const FrameworkVersion = "soc2-2017@1.0.0"
FrameworkVersion stamps every PolicyRef returned by this framework.
Variables ¶
This section is empty.
Functions ¶
func Controls ¶
Controls returns the SOC 2 (TSC 2017) control catalog: the common criteria (CC1–CC9) plus the Availability (A1), Confidentiality (C1), Processing Integrity (PI1), and Privacy (P-series) categories referenced by the policy library.
func ManualCatalog ¶
func ManualCatalog() map[string]manual.CatalogEntry
ManualCatalog returns one catalog entry per manual policy. The catalog ID equals each manual policy's CatalogEntry; cadence and grace period follow the policy's declared cadence.
func ManualCatalogExport ¶ added in v0.29.0
func ManualCatalogExport() manualcatalog.Catalog
ManualCatalogExport returns the descriptive, presentation-facing catalog for `sigcomply evidence catalog` (consumed by the Evidence SPA). Derived from the same manualSpecs() as the policy library, so the two cannot drift.
func Policies ¶
Policies returns the full SOC 2 policy library: automated checks (all pass_when: — no shipped policy uses the rule: escape hatch) and manual-evidence policies.
Source Files