The infrastructure side of SOC 2: open-source and self-hosted tools that run controls and produce evidence, GRC tools, building on AWS or Azure and using their SOC reports, and infrastructure as code as evidence.
Which open-source tools cover the controls SOC 2 auditors test most (identity and MFA, logging and detection, access reviews, secrets, vulnerability scanning, change control, GRC), their licenses and edition limits, and the evidence each produces.
Running SOC 2 control tracking, risk registers and evidence in a self-hosted GRC tool: what CISO Assistant and eramba Community do, their licenses (open core AGPL versus a free but not open-source license) and the features held back for paid editions.
Building a SOC 2 on AWS: getting AWS's SOC reports and bridge letters from AWS Artifact, what AWS's report covers and when, controls you inherit versus share or own under the shared responsibility model, and carving AWS out of your report.
Building a SOC 2 on Azure: which Microsoft services the SOC 2 Type 2 report covers, its schedule and quarterly bridge letters on the Service Trust Portal, the combined C5 and CSA STAR report, and the user entity responsibilities listed for customers.
How infrastructure as code, Kubernetes admission policies and CI pipelines turn change management and configuration controls into evidence: baselines and tracked changes under CC8.1, configuration standards under CC7.1, and the audit-log gaps in free editions.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.