The week Duebook’s last control had its evidence. Day one landed 7; the Lands column has the rest.
47 controls, and where each one’s evidence comes from
This is the whole list. Every control is mapped to the SOC 2 Trust Services Criteria it satisfies, with the source of its evidence and the ISO 27001 and HIPAA requirements it already covers. Auditors will sample from it. You should be able to read it in ten minutes. The Lands column is the week each one’s evidence landed for Duebook.
People and paper
Mostly the Binder. Policies you sign and an org chart Google Workspace already knows.
| Control | Lands | Name | Criteria | Evidence from | ISO 27001 | HIPAA |
|---|---|---|---|---|---|---|
| FP-01 | W1 | Information security policy approved | CC1.1, CC5.3 | Binder | A.5.1 | 164.316(a) |
| FP-02 | W1 | Code of conduct acknowledged by staff | CC1.1 | Binder | A.5.4 | — |
| FP-03 | W3 | Security oversight by board or advisor | CC1.2 | Second Look | A.5.4 | — |
| FP-04 | W2 | Security roles assigned and on the org chart | CC1.3 | Google Workspace | A.5.2 | 164.308(a)(2) |
| FP-05 | W5 | Background checks for new hires | CC1.4 | Second Look | A.6.1 | 164.308(a)(3) |
| FP-06 | W5 | Security awareness training completed | CC1.4, CC2.2 | Second Look | A.6.3 | 164.308(a)(5) |
| FP-07 | W1 | Control owners named and accountable | CC1.5 | Binder | A.5.2 | — |
| FP-08 | W1 | System description written | CC2.1 | Binder | A.5.9 | — |
| FP-09 | W3 | Security commitments published to customers | CC2.3 | Second Look | A.5.14 | — |
| FP-10 | D1 | Internal channel for reporting incidents | CC2.2 | Slack | A.6.8 | 164.308(a)(6) |
Risk
One risk assessment a year, written with a reviewer, not a 300-row risk register.
| Control | Lands | Name | Criteria | Evidence from | ISO 27001 | HIPAA |
|---|---|---|---|---|---|---|
| FP-11 | W5 | Annual risk assessment | CC3.1, CC3.2 | Binder | A.5.7 | 164.308(a)(1) |
| FP-12 | W4 | Fraud risk considered in risk assessment | CC3.3 | Binder | — | — |
| FP-13 | W4 | Changes in risk logged and reviewed | CC3.4 | Jira | — | — |
| FP-15 | W4 | Quarterly control review | CC4.1 | Fieldproof | — | — |
| FP-16 | W4 | Control failures tracked to a fix | CC4.2 | Jira | — | — |
| FP-17 | W1 | Policies mapped to controls | CC5.1, CC5.2 | Binder | — | — |
Access
The criteria auditors spend the longest on. Okta and AWS answer most of it automatically. The quarterly access review is the one you do by hand.
| Control | Lands | Name | Criteria | Evidence from | ISO 27001 | HIPAA |
|---|---|---|---|---|---|---|
| FP-18 | W2 | Unique accounts for every person | CC6.1 | Okta | A.5.16 | 164.312(a)(2)(i) |
| FP-19 | D1 | MFA enforced in Okta | CC6.1 | Okta | A.8.5 | 164.312(d) |
| FP-20 | D1 | MFA enforced in Google Workspace | CC6.1 | Google Workspace | A.8.5 | 164.312(d) |
| FP-21 | W2 | Root and admin access restricted in AWS | CC6.1, CC6.3 | AWS | A.8.2 | 164.312(a)(1) |
| FP-22 | W2 | Access granted only by approved request | CC6.2 | Jira | A.5.18 | 164.308(a)(4) |
| FP-23 | W5 | Access removed within 24 hours of departure | CC6.2 | Okta | A.5.16 | 164.308(a)(3)(ii)(C) |
| FP-24 | W2 | Quarterly access review | CC6.2, CC6.3 | Okta | A.5.18 | 164.308(a)(4) |
| FP-25 | D1 | Data encrypted at rest | CC6.1, CC6.7 | AWS | A.8.24 | 164.312(a)(2)(iv) |
| FP-26 | D1 | Data encrypted in transit | CC6.7 | AWS | A.8.24 | 164.312(e)(1) |
| FP-27 | W2 | Network access restricted by security groups | CC6.6 | AWS | A.8.20 | — |
| FP-28 | W2 | Production access logged | CC6.8, CC7.2 | AWS | A.8.15 | 164.312(b) |
| FP-29 | W5 | Laptop disk encryption | CC6.8 | Second Look | A.8.1 | 164.310(d) |
| FP-30 | W6 | Physical security inherited from AWS | CC6.4, CC6.5 | Second Look | A.7.1 | 164.310(a) |
Detection and incidents
Alerts from AWS, a plan in the Binder, one tabletop exercise a year.
| Control | Lands | Name | Criteria | Evidence from | ISO 27001 | HIPAA |
|---|---|---|---|---|---|---|
| FP-31 | W3 | Vulnerability scanning on production | CC7.1 | AWS | A.8.8 | — |
| FP-32 | W3 | Dependency alerts reviewed | CC7.1 | GitHub | A.8.8 | — |
| FP-33 | W3 | Alerts on anomalous activity | CC7.2 | AWS | A.8.16 | 164.308(a)(1) |
| FP-34 | W5 | Incident response plan | CC7.3, CC7.4 | Binder | A.5.24 | 164.308(a)(6) |
| FP-35 | W6 | Incident tabletop exercise | CC7.4, CC7.5 | Second Look | A.5.24 | — |
| FP-36 | W4 | Post-incident review written | CC7.5 | Jira | A.5.27 | — |
Change
GitHub shows the merged pull request and who approved it, and Jira shows the ticket it came from.
| Control | Lands | Name | Criteria | Evidence from | ISO 27001 | HIPAA |
|---|---|---|---|---|---|---|
| FP-37 | D1 | Pull requests require an approval | CC8.1 | GitHub | A.8.32 | — |
| FP-38 | W5 | Branch protection on main | CC8.1 | GitHub | A.8.32 | — |
| FP-39 | D1 | Changes traced to a ticket | CC8.1 | Jira | A.8.32 | — |
| FP-40 | W3 | Production separated from test | CC8.1 | AWS | A.8.31 | — |
| FP-41 | W3 | Infrastructure changes reviewed | CC8.1 | GitHub | A.8.9 | — |
Vendors, availability, confidentiality
Uploads, mostly. Your vendors' agreements and a restore test.
| Control | Lands | Name | Criteria | Evidence from | ISO 27001 | HIPAA |
|---|---|---|---|---|---|---|
| FP-14 | W6 | Vendor inventory reviewed | CC9.2 | Second Look | A.5.19 | 164.308(b) |
| FP-42 | W6 | Vendor agreements on file | CC9.2 | Second Look | A.5.20 | 164.308(b)(1) |
| FP-43 | W6 | Business continuity plan | CC9.1, A1.2 | Binder | A.5.30 | 164.308(a)(7) |
| FP-44 | W6 | Backups run and a restore tested | A1.2, A1.3 | AWS | A.8.13 | 164.308(a)(7) |
| FP-45 | W4 | Capacity monitored | A1.1 | AWS | A.8.6 | — |
| FP-46 | W4 | Confidential data identified | C1.1 | Binder | A.5.12 | — |
| FP-47 | W6 | Confidential data disposed of on schedule | C1.2 | Second Look | A.8.10 | 164.310(d)(2) |
The six Taps, and exactly what they read
- GitHub
Reads pull requests, reviews, branch protection rules and Dependabot alerts. Never reads file contents.
metadata:read · pull_requests:read · administration:read
- AWS
A read-only IAM role (SecurityAudit) reads IAM, encryption settings, security groups, CloudTrail, GuardDuty, Inspector and backup plans.
arn:aws:iam::aws:policy/SecurityAudit
- Okta
Reads users, groups, app assignments and MFA policy. Generates the access review population.
okta.users.read · okta.groups.read · okta.policies.read
- Google Workspace
Reads users, org units and 2-Step Verification enforcement.
admin.directory.user.readonly · admin.directory.orgunit.readonly
- Jira
Reads issues in the projects you choose, to trace changes and access requests to tickets.
read:jira-work (chosen projects)
- Slack
Confirms the #security-incidents channel exists and who is in it. Reads no messages.
channels:read · users:read
Uploaded evidence doesn’t count until a reviewer accepts it. In the last 90 days, the median time from upload to decision was 5 working hours. About one file in six is sent back, usually because it’s dated outside the period the auditor will look at.
| Control | File | Review | |
|---|---|---|---|
| FP-29 | filevault-status-34-laptops.csv 2 laptops missing (MBP-0217, MBP-0230). Export again after both report in. | H. Sato · 18 Aug | Sent back |
| FP-05 | background-checks-2026.zip (6) | I. Ferreira · 17 Aug | 2 of 6 left |
| FP-06 | training-completions-aug.csv | I. Ferreira · 26 Aug | 29 of 34 |
| FP-14 | vendor-inventory.xlsx | W. Okafor · 25 Aug | 3 unrated |
| FP-30 | aws-soc2-type2-2026.pdf | W. Okafor · 27 Aug | Reviewing |
| FP-42 | dpa-postmark.pdf | R. Adeyemi · — | Awaited |
| FP-47 | retention-schedule-v2.pdf | I. Ferreira · 28 Aug | Reviewing |