SOC 2 Readiness

SOC 2 Readiness

The compliance plugin produces a SOC 2 Type 1 evidence pack for tenants who serve enterprise clients. The pack gives a third-party auditor everything they need to start an attestation without manual data collection.

Requires: Enterprise license, NSELF_COMPLIANCE_SOC2=true

What is in the pack

The exported ZIP covers all five Trust Service Criteria:

File	TSC	Contents
CC6-user-provisioning-log.csv	CC6	Access grant and revocation events
CC6-access-review.csv	CC6	Quarterly access review records
CC7-change-management.csv	CC7	Config, plugin, schema, user changes
CC9-vendor-list.csv	CC9	Vendor registry with risk tiers
A1-availability-metrics.csv	A1	Service health events by day
policies/*.md	All TSCs	Five rendered policy documents
manifest.sha256	—	SHA-256 hash of every file

Generating a pack

nself compliance soc2 evidence --from 2026-01-01 --to 2026-06-30

Or via the API:

curl -X POST https://api.your-instance.com/api/v1/compliance/soc2/evidence \
  -H "X-Nself-License-Tier: business" \
  -H "Content-Type: application/json" \
  -d '{"from":"2026-01-01","to":"2026-06-30"}' \
  --output soc2-evidence.zip

Verify integrity:

unzip soc2-evidence.zip manifest.sha256
sha256sum -c manifest.sha256

Access reviews (CC6)

Schedule and complete quarterly access reviews:

# Open a review
curl -X POST .../api/v1/compliance/access-reviews \
  -d '{"period_start":"2026-01-01","period_end":"2026-03-31"}'

# Close it with findings
curl -X PATCH .../api/v1/compliance/access-reviews/:id \
  -d '{"status":"complete","findings":{"accounts_reviewed":42,"access_removed":3}}'

Change log (CC7)

Record every infrastructure change before it is applied:

curl -X POST .../api/v1/compliance/change-log \
  -d '{
    "change_type": "schema",
    "description": "Added np_change_log index for tenant_id",
    "ticket_ref": "NSELF-456",
    "approved_by": "<admin-uuid>"
  }'

Change types: config plugin user schema

Policy documents

Five policy templates are rendered and included in every evidence pack. Customize them before submitting to your auditor:

• Access Control Policy (CC6)
• Change Management Policy (CC7)
• Incident Response Policy (CC7, A1)
• Vendor Management Policy (CC9)
• Business Continuity Policy (A1)

Feature flags

Variable	Required	Effect
nself	Yes	Enables SOC 2 dashboard
nself	Yes	Enables evidence download
nself	Enterprise	Continuous monitoring
nself	No	MinIO bucket for pack storage
nself	No	Presigned URL TTL (seconds, default 86400)

Database tables

Table	Purpose
np_change_log	Change management records (CC7)
np_access_reviews	Access review records (CC6)
np_vendor_registry	Vendor inventory (CC9)

Tables are created automatically when the compliance plugin starts.

Permissions

Role	Access
compliance:read	View controls, reviews, change log
compliance:export	Generate and download evidence packs
compliance:admin	Manage vendor registry, approve reviews

All endpoints return 401 without an Enterprise license.