name: soc2-basic
description: SOC 2 Basic Compliance Guidelines
category: security
rules:
  - "Enforce multi-factor authentication (MFA) for all user and administrative access to production systems"
  - "Implement role-based access control (RBAC) with least-privilege — review and recertify access quarterly"
  - "Log all system access, configuration changes, and data operations to a centralized, tamper-evident logging system"
  - "Establish a formal change management process — all production changes require review, approval, and rollback plans"
  - "Conduct regular vulnerability scans and penetration tests — remediate critical findings within defined SLAs"
  - "Implement automated monitoring and alerting for system availability, performance anomalies, and security events"
  - "Maintain and test an incident response plan — define roles, escalation paths, communication templates, and post-mortem processes"
  - "Encrypt sensitive data at rest (AES-256) and in transit (TLS 1.2+) across all system components"
  - "Perform vendor security assessments before onboarding third-party services that process or store customer data"
  - "Implement automated backups with defined RPO/RTO targets and test restoration procedures at least annually"
  - "Enforce separation of duties — no single person should be able to deploy code, approve changes, and access production data"
  - "Revoke access to all systems within 24 hours of employee termination or role change"
  - "Maintain a documented and enforced data classification policy — label data as public, internal, confidential, or restricted"
  - "Implement network segmentation — isolate production, staging, and development environments from each other"
  - "Require security awareness training for all employees and contractors with access to customer data at least annually"