Capstone: Automate a SOC 2 Control Family

One family, every layer

This capstone takes the logical access family, provisioning, access review, privileged access, removal, MFA, and runs it through everything the previous nineteen rooms covered: catalog record, policy as code, CI gate, evidence collector, immutable store, continuous monitor, auditor-facing report.

The thread that makes it one system rather than seven projects is the control id. It appears in the catalog record, in the policy annotation, in the collector output, in the monitor and in the report, so any number in the report can be traced back to the rule that produced it.

Sequence matters more than tooling

Catalog first, because everything else references it. Then evidence collection, because it tells you what reality currently looks like and how bad the gap is. Then monitoring, then enforcement: enforcement last, because a gate switched on before you know your violation rate blocks the entire engineering organisation on day one.

The common failure is starting with the enforcement layer because it is the most satisfying to build, then discovering the control catalog it enforces was never agreed.

Measure before you block. The violation rate tells you whether the gate is a guardrail or an outage.

Type 2 is about the period, not the day

A Type 2 report opines on operating effectiveness across a defined period. Automation that went live in month five leaves months one to four to be evidenced some other way, and no amount of elegant tooling retroactively covers them.

So either the automation starts before the period, or the period starts after the automation, or you plan a documented manual bridge for the gap. Deciding this late is how a well-built program produces a qualified opinion.

What you actually hand over

The control definitions and their framework mappings. The policy code and its tests, including the negative ones. Evidence for the full period, with run metadata proving completeness. The exception register with approvals and expiry dates. Monitor output showing freshness. And a walkthrough that lets the auditor re-perform one control end to end themselves.

Re-performance is the moment automation pays off. An auditor who can run your query and get your number stops sampling your spreadsheet.

Then hand it to someone else

A capstone that only its author can operate is a prototype. Owners, runbooks, alert destinations and a documented failure mode for every collector are what turn it into a control that survives your holiday.

Include a deliberate decommissioning path too: how a control is retired, how its historic evidence stays readable, and who is told. Programs accumulate automation nobody understands precisely because nobody planned the ending.