[olafkfreund]

Part of #324 (evidence & audit-readiness). This adds the per-framework gap assessment. The residual-risk sign-off is deliberately left unsigned for the Security Owner.

• Intent: intent/2026-11-07-324-soc2-gap-assessment.md
• Spec: spec/2026-11-07-324-soc2-gap-assessment.md
• Plan: plan/2026-11-07-324-soc2-gap-assessment.md

What changed

• New docs/compliance/soc2-gap-assessment.md: one row for each of the 38 TSC criteria (Security CC1-CC9, Availability A1, Confidentiality C1). Each row gives status, evidence, gap, register risk and issue. The ratings are capped by the SoA. The result is 0 Met, 24 Partial and 14 Gap. It also has an ISO 27001 summary that points at the SoA, plus an unsigned sign-off table. Processing Integrity is excluded and Privacy is deferred; both are open for the owner to reverse at sign-off.
• SoA summary table: Partial now has its own column, so the totals read 54/4/18/17. The old table showed 58 Implemented because it folded Partial in.
• Control matrix: the [compliance] Evidence & audit-readiness — control-to-framework matrix, automated evidence, gap assessments #324 row moves from Gap to Partial, and the evidence-collection section describes the live collector and access-review push. The code-scanning snapshot is still blocked on the evidence-github-token secret.
• README: links the new document.

Who did what

• Step 1 (SOC 2 document): coder (Sonnet). Review fixes were done by the lead.
• Step 2 (SoA table): codex.
• Steps 3-4 (matrix, README): agy.

Reviews

• Final reviewer: a fresh Opus agent, given the plan and the diff, plus codex (gpt-6.1-sol). Both found the same two issues:
  • The ceiling-rule wording was ambiguous; the legend now states the rule the rows follow.
  • Rows A1.3, CC7.5 and CC9.1 said no restore drill had run; they now cite the 2026-08-10 restore drill.
• CC6.2: the review-cadence and access-review-push statements contradicted each other; the row now reconciles them.
• agy review: not obtained, UNAVAILABLE (code 503): No capacity available for model gpt-oss-120b-medium on the server.

Tests

All of the plan's Tests 1-8 pass:

• the exact criterion set, allowed statuses, per-category reconciliation, evidence present, risk IDs present, unsigned sign-off, SoA counts and relative links;
• gitleaks pre-commit.

Left for the owner

• Sign-off. Before signing, refresh the stale risk-register rows R-001, R-006, R-008, R-009, R-011 and R-013 (reported by the [Epic] Security & compliance program — audit-readiness for ISO 27001 / SOC 2 / SOX / PCI DSS / FedRAMP / FFIEC / NYDFS / SEC #310 team). Off-cluster backup has no tracking issue since factory-gitops#70 was closed.
• Code-scanning snapshot. Mint the evidence-github-token secret.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WtDyDqabJ8SR4gD3ubwYx1