SOC2 Compliance Pack

{ "field": "mfa_enabled", "operator": "equals", "value": false }

Access to sensitive data must be protected by multi-factor authentication.

• Average Fine: $4.88M (Average cost of credential-based breach)
• Breach Example: Uber 2022 — Contractor account without MFA allowed internal network pivot

{ "field": "contains_secrets", "operator": "equals", "value": true }

Controls should prevent unauthorized use of credentials.

• Average Fine: $2M (Average cost of secret key exposure in public repositories/DBs)
• Breach Example: Twitter 2023 — Private keys leaked in source code allowed API takeover

{ "field": "is_active_user", "operator": "equals", "value": false }

Access is modified or terminated in a timely manner.

• Average Fine: $150k (Common administrative fine for failed access reviews)
• Breach Example: Terminated employee used valid credentials to delete production databases

{ "field": "has_audit_log", "operator": "equals", "value": false }

Monitoring activities must be performed to identify anomalies.

• Average Fine: $1.2M (Cost increase when detection/containment exceeds 200 days)
• Breach Example: Company unable to determine extent of breach due to disabled database logs

{ "field": "last_backup_age_hours", "operator": "greater_than", "value": 24 }

The entity protects the system against environmental risks.

• Average Fine: $5.1M (Average cost of ransomware data loss)
• Breach Example: Cloud service provider lost 2 weeks of customer data during cluster failure

{ "field": "is_encrypted", "operator": "equals", "value": false }

The entity protects confidential information during its processing lifecycle.

• Average Fine: $18M (British Airways breach — lack of security measures)
• Breach Example: Unencrypted S3 buckets exposed 100M+ user records in plain text

{ "field": "region_mismatch", "operator": "equals", "value": true }

Entity communicates privacy objectives to internal and external parties.

• Average Fine: €1.2B (Meta — transferring data to US without valid basis)
• Breach Example: French health data host fined for using non-EU cloud providers without consent

{ "field": "tenant_id", "operator": "equals", "value": "MISMATCH" }

Customer data must be logically isolated from other customers.

• Average Fine: $3.5M (Average fine for cross-tenant data leak)
• Breach Example: SaaS provider leaked private reports to competitors due to query logic error

{ "field": "age_years", "operator": "greater_than", "value": 7 }

Personal information is retained for only as long as necessary.

• Average Fine: $1M (Sears — retaining customer tracking data post-consent withdrawal)
• Breach Example: Startup failing audit because “Deleted Users” table still contained full PII from 2016

• Multi-factor authentication for sensitive data access
• No hardcoded credentials or leaked API keys
• Timely revocation of access for terminated users
• Comprehensive audit trails for all administrative actions

• Critical data backed up within 24 hours
• Protection against data loss from ransomware or system failures

• PII encrypted at rest in all databases
• Data stored only in authorized geographic regions

• Multi-tenant SaaS applications prevent cross-tenant data leaks
• Data exports contain only records belonging to the requesting customer

• Data not retained beyond legal or business requirements (7-year default)
• Automated purge for records exceeding retention period