The problem
A first SOC 2 asks a company to prove things it may never have written down: who can change production, how long backups are kept, how secrets are stored, how a region is rebuilt after a disaster. Collecting screenshots once is possible. Collecting them again every year, for every control, with a growing team, is what wears companies down. The goal was evidence that stays true between audits without extra work.
What Nuno did
Nuno wrote the infrastructure control evidence, about 17 documents, each tied to something that already existed in code or in AWS. Backup retention came from AWS Backup plans selected by a tag, with daily, weekly, monthly and yearly tiers, and database backups kept for 35 days. Network evidence came from a diagram with three subnet tiers and security groups that deny by default. Audit logs came from CloudTrail at the organization level. Change management was the merge request history of the infrastructure repository, since capacity changes went through code review. Production deploys were limited to protected CI environments. Kubernetes secrets were encrypted in Git, first with SOPS and AWS KMS, later with Sealed Secrets. Access to production used single sign-on with MFA. Nuno rewrote the disaster recovery procedure around Terraform and tested redeploying the Kubernetes tooling and infrastructure from code.
Keeping it
The first report is the hard one. After that, the work is to keep the controls true while the platform changes. Because most evidence pointed at code and at AWS settings, a new service or region inherited the same backup tags, the same review process and the same secrets handling. Nuno updated the procedure documents as the platform moved, for example when disaster recovery moved to Terraform.
Results
The company obtained its first SOC 2 and kept it for 3 to 4 consecutive years. The infrastructure evidence came mostly from code and AWS settings that already existed, so each new audit period started from the same controls instead of a new collection effort.
Solutions
Evidence from code
- Tag-driven AWS Backup plans with daily, weekly, monthly and yearly retention tiers.
- Infrastructure changes through merge requests, so the history is the change log.
- Organization-wide CloudTrail.
Access and secrets
- Single sign-on with MFA for AWS and production access.
- Production deploys limited to protected CI environments.
- Kubernetes secrets encrypted in Git with SOPS and AWS KMS, later Sealed Secrets.
Recovery
- Disaster recovery procedure based on Terraform.
- Tested redeploy of Kubernetes tooling and infrastructure from code.
