TC-102: Create SOC 2 Standards Bundle

[tim-mccrimmon]

Overview

Purpose: Create a standards bundle encoding SOC 2 (System and Organization Controls) requirements for service organizations

Owner Role: Security Auditor / Compliance Officer - Expert in SOC 2 compliance and security controls

Bundle Type: standards

Phase: Phase 1 (Build Bundles - DRAFT)

Difficulty: Intermediate

Priority: P1-High
Labels: phase-1-build, bundle-standards, testing

---

What You're Creating

A standards bundle containing SOC 2 Trust Services Criteria that can be imported by SaaS and service provider projects.

Why This Matters

• SOC 2 is the industry standard for service organizations handling customer data
• SaaS companies need SOC 2 Type II certification for enterprise customers
• This bundle provides reusable SOC 2 context for all projects requiring compliance
• External auditors or compliance teams create these bundles once, projects import them

SOC 2 Trust Services Criteria

1. Security - Protection against unauthorized access (Required)
2. Availability - System is available for operation as committed (Recommended)
3. Processing Integrity - System processing is complete, valid, accurate, timely (Optional)
4. Confidentiality - Confidential information is protected (Recommended)
5. Privacy - Personal information is collected, used, retained, disclosed per commitments (Optional)

Expected Deliverables

• Source materials: ./notes/soc2-source-materials.md
• SOC 2 Type II SCD: ./scds/soc2-type2.yaml
• SOC 2 standards bundle (DRAFT): ./bundles/soc2-standards.yaml
• Versioned bundle: ./bundles/bundle-soc2-standards-1.0.0.yaml
• Test notes: ./notes/test-notes.md

Success Criteria

• SOC 2 Type II SCD created with all 5 Trust Services Criteria
• Standards bundle created and validated
• Bundle versioned successfully
• All criteria accurately represented
• Obligations are specific and actionable
• Audit requirements documented

Test Case Location

test-plan/standards/soc2/TC-102-soc2-standards.md

---

Moved from: OICP#3