Well-Architected & DevSecOps Review
SOC 2 Readiness on AWS
The infrastructure half of SOC 2, handled before the auditor arrives.
- Turnaround
- 10 business days
- Who it is for
- Teams with a Type I or Type II audit scheduled in the next two quarters.
01 — The problem
SOC 2 fails on evidence, not intent. Controls exist but cannot be demonstrated: logs are not retained long enough, access reviews were never recorded, and change management lives in people’s heads.
02 — What is included
Exactly what you get, and nothing vague.
- Control mapping against the common criteria relevant to infrastructure
- CloudTrail, Config and log retention configured to satisfy evidence requirements
- Access review process that produces an artefact an auditor accepts
- Change management evidence via pipeline, not via screenshots
- Gap list with owners and a realistic sequence before the audit window
03 — What this usually finds
The recurring ones, named up front.
- CloudTrail not enabled in every region
- Log retention shorter than the audit period
- Shared root or break-glass accounts with no monitored usage
- Production changes possible outside the pipeline
Listed because they recur, not because they are guaranteed. The audit reports what is actually there.
Next step
Twenty minutes to find out whether this is worth doing.
Every engagement runs under a signed mutual NDA with a read-only IAM role. If the audit would not pay for itself, I will say so on the call.