SOC 2 Type II Implementation Plan

1. Overview

Authoritative SOC 2 implementation reference for Meridian Seven.

Operating model:

No dedicated GRC platform (no Vanta/Drata).
No Okta at current scale — reconsider at 10-15 headcount.
No Linear for compliance workflow.
Compliance is GitHub-native: Issues + Project for control execution, evidence/ for artifacts.

2. Compliance Stack

System	Role in Control Environment
Google Workspace Enterprise Standard	Primary IdP, MFA, endpoint policy, CAA, DLP, admin logs
CrowdStrike Falcon	Endpoint NGAV/EDR, containment, host telemetry
Cloudflare (WAF + Zero Trust + CASB)	Boundary protection, access policy, SaaS posture
1Password Business	Human credential governance, shared vault controls, Watchtower
Doppler	Runtime/application secrets authority
GitHub Team	Change management, issue workflow, CI/CD
GitHub Secret Protection	Secret leak prevention and push protection
GCP Cloud Monitoring	Uptime checks/alert policies/notification channels/incident timelines
Slack	Alert routing and incident communication
Supabase / GCP Cloud Run	Production platform operations and logs
Backblaze B2 + Cube Backup	Backup/recovery controls

3. Control Coverage Matrix

Control Area	Primary Systems
CC1.1-1.4 Control environment	Policies (repo), GitHub Project, role ownership
CC2.1-2.3 Communication	Slack, GitHub Issues, procedures in repo
CC3.1-3.4 Risk assessment	CrowdStrike, 1Password Watchtower, vendor register
CC4.1-4.2 Monitoring activities	GCP Cloud Monitoring, GitHub Issues/Project, evidence manifests
CC5.1-5.3 Control activities	Google policy enforcement, GitHub rulesets, Doppler controls
CC6.1 Logical access	Google IdP/MFA, Cloudflare Access, GitHub org controls
CC6.2 Credential controls	1Password + Doppler + Google password/MFA policy
CC6.3 Provisioning/deprovisioning	Google lifecycle + GitHub workflow checklists + monthly access review
CC6.4 Asset protection	Google endpoint management + CrowdStrike
CC6.5 System operations — restrict data movement	Cloudflare WAF + rate limiting, Google DLP
CC6.6 Boundary/system protection	Cloudflare + CrowdStrike + Google CAA
CC6.7 Restrict data movement	Google DLP + Doppler segmentation + Cloudflare policies
CC7.1 Infrastructure monitoring	GCP Cloud Monitoring + CrowdStrike + platform logs
CC7.2 Anomaly detection	GCP Cloud Monitoring alert policies + CrowdStrike detections + Google anomalies
CC7.3 Evaluate events	Incident workflow in GitHub Issues + GCP Cloud Monitoring alerts + retained artifacts
CC7.4 Incident response	GCP Cloud Monitoring alerts → Slack notification channel + post-mortem via Slack modal + GitHub incident issues
CC7.5 Recovery	Cube/Backblaze + Supabase PITR + restoration tests
CC8.1 Change management	GitHub PR workflow, branch protection, required checks
CC9.1-9.2 Risk mitigation/vendor mgmt	Vendor register + policy set + backup architecture

4. Provisioning and Access Management

Google Workspace is the source of truth for workforce identity. MFA is mandatory everywhere.

Joiner / Mover / Leaver

Every onboarding, role change, and offboarding is tracked via the access-provision.yml workflow and GitHub issue.
The provisioning.py automation handles system access changes; manual items (1Password, CrowdStrike) are completed by the owner.
Issue templates define required system actions and evidence attachments.
Offboarding SLA: 24 hours (1 hour for involuntary).

Systems Covered by Checklist Workflow

Google Workspace, GitHub, Slack, 1Password, GCP IAM, Supabase, Doppler, Cloudflare.

Review Cadence

Monthly access review issue auto-created by GitHub Actions. Reviewer compares expected roster against every in-scope system. Discrepancies remediated and documented in linked issues.

5. Evidence Architecture

Storage

Working documents, policies, procedures, guides in repository.
Operational evidence under evidence/.

Evidence Folder Standard

evidence/
  README.md
  automation/manifests/YYYY/MM/DD/
  weekly-security-reviews/YYYY/
  monthly-access-reviews/YYYY/
  incidents/YYYY/
  vulnerabilities/YYYY/
  access/onboarding/YYYY/
  access/offboarding/YYYY/
  logs/
    github/YYYY/MM/
    gcp-monitoring/YYYY/MM/
    cloudflare/YYYY/MM/
    crowdstrike/YYYY/MM/
    google-workspace/YYYY/MM/
    supabase/YYYY/MM/
  restoration-tests/YYYY/QN/
  vendor-reviews/YYYY/

Automation Principles

Scheduled GitHub issue creation for recurring control execution.
Daily evidence manifest generation for file integrity tracking.
Automated repository snapshots for GitHub-native control evidence.
External-system evidence ingested to evidence/logs/ with source/date naming.

6. Operating Cadence

Process	Frequency	System of Record	Owner
Weekly security review	Weekly (Monday)	GitHub Issue + `evidence/weekly-security-reviews`	CTO
Monthly access review	Monthly (1st)	GitHub Issue + `evidence/monthly-access-reviews`	CISO
Vulnerability remediation	Event-driven	GitHub Issue + `evidence/vulnerabilities`	CTO
Incident response/postmortem	Event-driven	GitHub Issues + `evidence/incidents`	CISO
Backup restoration test	Quarterly	GitHub Issue + `evidence/restoration-tests/YYYY/QN`	CTO
Vendor review	Quarterly/Annual by tier	`guides/Vendor-Register.md` + `evidence/vendor-reviews`	CISO

7. Automation Workflows

Workflow	Schedule (UTC)	Systems
`evidence-collector.yml`	06:20 daily	GitHub (API snapshots + SHA-256 manifests)
`evidence-gcp.yml`	06:30 daily	GCP Cloud Monitoring
`evidence-cloudflare.yml`	06:40 daily	Cloudflare
`evidence-crowdstrike.yml`	06:50 daily	CrowdStrike
`evidence-google.yml`	07:00 daily	Google Workspace
`evidence-supabase.yml`	07:10 daily	Supabase
`evidence-external.yml`	07:20 daily	Doppler, 1Password, Slack, Backblaze
`system-verify.yml`	05:00 nightly	All systems
`access-provision.yml`	On demand (workflow_dispatch)	All provisioning-covered systems

Workflows staggered 10 minutes to prevent git push conflicts. Missing credentials produce SKIP results, not failures. All automations are part of the control design and must remain enabled.

Automation modes:

bootstrap — Configure SOC2-required settings (idempotent, dry-run supported)
verify — Check config against expected state (read-only)
evidence — Collect audit logs and snapshots to evidence/logs/

8. Project Tracking

Linear is for strategic roadmap tracking only. Automated workflows (security-cadence.yml, access-provision.yml) handle operational cadence — weekly reviews, monthly access reviews, onboarding, and offboarding. Control execution records and evidence are GitHub-native.

Linear Project: SOC 2 Type II Implementation

Meridian Seven — Confidential