Documentation
¶
Overview ¶
Package soc2 is the SOC 2 (TSC 2017) framework: the control catalog, the automated policy library expressed in the pass_when: DSL, and the manual-evidence policies. Every shipped policy is pass_when: or manual — Rules() returns nil (no rule: escape hatch is used today; the infrastructure remains available for a future check the DSL cannot express).
Policies are authored as Go values via the compact builders in this file. Most automated checks reduce to "every / no / some record in a slot satisfies a field condition" — exactly what the pass_when DSL expresses without a line of Go.
Every evidence type a shipped policy accepts has a registered emitter (enforced at build time by internal/sources/builtin/coverage_test.go), so there are no inert "deferred-source" policies in-tree. A new evidence type added ahead of its source must ship a source in the same change or the coverage test fails.
Index ¶
Constants ¶
const FrameworkID = "soc2"
FrameworkID is the registered identifier.
const FrameworkVersion = "soc2-2017@1.0.0"
FrameworkVersion stamps every PolicyRef returned by this framework.
Variables ¶
This section is empty.
Functions ¶
func Controls ¶
Controls returns the SOC 2 control catalog: the 2017 Trust Services Criteria (revised points of focus, 2022) that the policy library maps to. That is all 33 common criteria, the three Availability and two Confidentiality criteria, and only PI1.1 of Processing Integrity and P1.1, P3.1, P4.2 and P4.3 of Privacy. The other 4 PI and 14 P criteria are not modeled; docs/reference/frameworks.md says so.
func ManualCatalog ¶
func ManualCatalog() map[string]manual.CatalogEntry
ManualCatalog returns one catalog entry per manual policy. The catalog ID equals each manual policy's CatalogEntry; cadence and grace period follow the policy's declared cadence.
func ManualCatalogExport ¶ added in v0.29.0
func ManualCatalogExport() manualcatalog.Catalog
ManualCatalogExport returns the descriptive, presentation-facing catalog for `sigcomply evidence catalog` (consumed by the Evidence SPA). Derived from the same manualSpecs() as the policy library, so the two cannot drift.
func Policies ¶
Policies returns the full SOC 2 policy library: automated checks (all pass_when: — no shipped policy uses the rule: escape hatch) and manual-evidence policies.
Source Files