This repository scores only the controls that are actually wired: 8
technical OPA/Rego checks and 9 procedural date manifests. Other IDs in
catalog/ are not part of the score. See catalog/README.md.
A score is evidence about those wired checks. It is not a CPA opinion, not a SOC 2 Type I/II report, and not an ISO/IEC 27001 certification. An auditor still opines. See SECURITY.md.
An empty payload or an empty list scores MISSING. A deny rule that sees no rows is not a pass.
| Layer | In this repo | What the scorer uses |
|---|---|---|
| L0 Catalog | catalog/ |
Wired IDs only. The YAML still lists controls this job does not run |
| L1 Policy | policies/ |
The 10 Rego packages in engine/jobs.yaml, plus lib.payload (empty input is not a pass) |
| L2 Sensors | sensors/ |
GitHub, Terraform, and procedural manifests. Cloud, Kubernetes, and SAST adapters are stubs and are not scored |
| L3–L4 Engine | engine/ |
Evaluator + clean/effective scorer |
| L5 Locker | evidence/ + docker-compose.yml |
Dev locker image is pgsty/silo (Docker Hub deleted minio/minio). Prod replica is stubbed |
| L6 Waivers | exceptions/ |
Time-boxed policy-as-data. Waivers do not count as clean |
| L7 IaC gate | scripts/iac_gate.sh |
Warn-mode sample Terraform for encryption at rest and the infrastructure approval gate |
Current wired slice: 11 technical + 9 procedural controls of 37 catalog entries. Unimplemented Rego is reported separately from the score so a missing package does not count as green.
- A SOC 2 certification, attestation, or CPA opinion
- An ISO/IEC 27001 certification
- A standalone GRC / audit product or a replacement for an ISMS, SIEM, or production object-lock locker
- Evidence you can show an auditor without replacing sample manifests, fixtures, and demo locker credentials with your own systems
- A new corporate-site-harness program (that wiring is a later factory slice; see DESIGN-PIVOT.md)
Definition of Done (hermetic):
./scripts/verify.shRequires python3, PyYAML,
OPA, and
Terraform on PATH.
Install the wired scorer from this checkout, then run it. pip install -e . puts soc2-score on PATH. Policies stay in this tree; an empty sensor payload scores MISSING, not PASS. This is not a certification.
pip install -e .
soc2-scorepython3 -m engine.run is the same command.
IaC gate over terraform-examples/ (intentional unencrypted RDS should appear
as a finding; warn exits 0, enforce exits 1):
./scripts/iac_gate.sh warnOptional local evidence locker (demo credentials only — localhost):
docker compose up -d| Path | Role |
|---|---|
| catalog/ | Wired control IDs this scorer runs |
| policies/ | Rego library + opa test |
| sensors/ | Normalized JSON adapters (GitHub/org, Terraform, procedural) |
| engine/ | Eval, score, waivers |
| evidence/ | Locker client, Merkle log, auditor packaging |
| docs/DESIGN-PIVOT.md | Sensor-pack positioning (not a GRC product) |
| docs/readiness-layer-design.md | Architecture (design + implemented Phase 1) |
| AGENTS.md | Agent verify contract |
| CONTRIBUTING.md | How to propose changes |
docs/README.md lists the repository layout. Community policy files are the root CONTRIBUTING.md, CODE_OF_CONDUCT.md, and SECURITY.md.