> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortex.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure SOC 2 compliance

export const RecipeBadges = ({badges = []}) => {
  const map = {
    "recipe": {
      label: "Recipe",
      color: "#A86400"
    },
    "ai-excellence": {
      label: "AI excellence",
      color: "#653EE8"
    },
    "production-readiness": {
      label: "Production readiness",
      color: "#226686"
    },
    "incident-mgmt": {
      label: "Incident management",
      color: "#86198F"
    },
    "migrations": {
      label: "Migrations",
      color: "#0E7C66"
    },
    "compliance": {
      label: "Compliance",
      color: "#475569"
    },
    "dora": {
      label: "DORA metrics",
      color: "#1D4ED8"
    },
    "security": {
      label: "Security",
      color: "#B42318"
    },
    "operational-readiness": {
      label: "Operational readiness",
      color: "#B54708"
    },
    "dev-onboarding": {
      label: "Developer onboarding",
      color: "#C11574"
    }
  };
  const items = badges.map(key => map[key]).filter(Boolean);
  if (items.length === 0) return null;
  return <div className="not-prose flex flex-wrap gap-2 mb-6">
      {items.map(b => <span key={b.label} className="rounded-lg px-2 py-1 text-xs font-medium" style={{
    backgroundColor: b.color,
    color: b.textColor || "#FFFFFF"
  }}>
          {b.label}
        </span>)}
    </div>;
};

<RecipeBadges badges={["recipe", "compliance"]} />

Cortex enables streamlined SOC 2 compliance by eliminating manual, spreadsheet-based tracking and connecting real time system data to control verification.

To improve consistency across your compliance tracking:

* You can [launch a SOC 2 Compliance Scorecard](/guides/compliance/soc2#create-a-soc-2-scorecard). Cortex provides a prebuilt SOC 2 compliance [Scorecard](/standardize/scorecards) template that you can use to track audit-related controls and standards.
* You can [launch an Initiative](/guides/compliance/soc2#create-a-soc-2-initiative) associated with the Scorecard, which gives your engineers a deadline for when to complete certain goals.
* [Use reports and Cortex MCP](/guides/compliance/soc2#measuring-success) to better understand progress and next steps.

## Create a SOC 2 Scorecard

### Prerequisites

Before using this Scorecard template:

* Ensure you have configured integrations for:
  * Version control: [Azure DevOps](/ingesting-data-into-cortex/integrations/azuredevops), [Bitbucket](/ingesting-data-into-cortex/integrations/bitbucket), [GitHub](/ingesting-data-into-cortex/integrations/github), or [GitLab](/ingesting-data-into-cortex/integrations/gitlab).
  * [PagerDuty](/ingesting-data-into-cortex/integrations/pagerduty)
  * [Snyk](/ingesting-data-into-cortex/integrations/snyk)
    * This Scorecard uses Snyk for its vulnerability scanning rules, but the rules can be modified to check vulnerability data from [Checkmarx](/ingesting-data-into-cortex/integrations/checkmarx), [Mend](/ingesting-data-into-cortex/integrations/mend), [Semgrep](/ingesting-data-into-cortex/integrations/semgrep), [Veracode](/ingesting-data-into-cortex/integrations/veracode), or [Wiz](/ingesting-data-into-cortex/integrations/wiz).
      * See [CQL Explorer](https://app.getcortexapp.com/admin/queries) in your Cortex workspace for example queries for these integrations.
* Ensure you have [created custom data fields](/ingesting-data-into-cortex/entities-overview/entities/custom-data) called `tls_enabled` and `last_risk_assessment_date`.

### Step 1: Create the Scorecard and configure its basic settings

You can create a Scorecard in the Cortex UI, or you can add it to your workspace via GitOps or the Cortex API.

<Tabs>
  <Tab title="Cortex UI">
    #### Create Scorecard in the Cortex UI

    1. On the [**Scorecards** page](https://app.getcortexapp.com/admin/scorecards) in your workspace, click **Create Scorecard**.
    2. On the `SOC-2 Compliance` template, click **Use**.
    3. Configure basic settings, including the Scorecard's name, unique identifier, description, and more.
       * Learn about configuring the basic settings in the [Creating a Scorecard documentation](/standardize/scorecards/create).
  </Tab>

  <Tab title="GitOps or API">
    #### Create Scorecard via GitOps or API

    When following a [GitOps approach](/configure/gitops), you can add a Scorecard YAML file to your `.cortex/scorecards` directory in your version control repository. Note that GitOps must be enabled for Scorecards in your [GitOps settings](/configure/settings/gitops-settings).

    You could also use the [Cortex API,](/api/rest/scorecards) where you can submit a Scorecard definition in YAML.

    <Accordion title="SOC 2 Scorecard YAML">
      Use the YAML file below to add this Scorecard to your workspace via the API or via a GitOps flow.

      ```yaml theme={null}
      tag: soc-2
      name: SOC 2 Compliance
      description: |-
        Ensure services meet SOC 2 requirements by tracking key security, operational, and maturity controls including ownership, TLS, vulnerability scans, and risk assessments.

        (Created from Scorecard template)
      draft: false
      notifications:
        enabled: false
        scoreDropNotificationsEnabled: false
      exemptions:
        enabled: true
        autoApprove: false
        userSpecificNotifications: false
      ladder:
        name: Default Ladder
        levels:
        - name: Foundational Security
          rank: 1
          color: "#c38b5f"
        - name: Operational Compliance
          rank: 2
          color: "#8c9298"
        - name: Advanced SOC 2 Maturity
          rank: 3
          color: "#cda400"
      rules:
      - title: Pen test linked
        expression: links("pen-test").length > 0
        identifier: 1ac74f97-0e8a-3d5c-bde2-f71890c34f6d
        weight: 1
        level: Advanced SOC 2 Maturity
        failureMessage: "Add a link of type pen-test by following the instructions in [our\
          \ docs](https://docs.cortex.io/ingesting-data-into-cortex/entities-overview/entities/external-docs#add-links-to-an-entity)."
      - title: On-call is set
        expression: oncall != null
        identifier: 2a2e6d7e-9ea1-3df6-a2a1-8db501126d53
        weight: 1
        level: Foundational Security
        failureMessage: "Add an on-call rotation by following the instructions in our docs\
          \ for the [on-call integration](https://docs.cortex.io/ingesting-data-into-cortex/integrations#on-call)\
          \ your team uses."
      - title: Service has ownership
        expression: ownership != null
        identifier: 2d3e1a5a-2012-3b28-b561-dd31c73117aa
        weight: 1
        level: Foundational Security
        failureMessage: "Add an owner by following the instructions in [our docs](https://docs.cortex.io/ingesting-data-into-cortex/entities-overview/entities/ownership)."
      - title: Service included in Risk Assessment in last year
        expression: custom("last_risk_assessment_date").fromNow() > duration("P1Y")
        identifier: 66283efc-364e-3b29-9f00-9fb4bcc6e785
        weight: 1
        level: Advanced SOC 2 Maturity
      - title: TLS is enabled
        expression: custom("tls_enabled") == true
        identifier: 887c666a-09bd-3ab8-95e3-ff005e68563d
        weight: 1
        level: Foundational Security
      - title: Branch protection is set on default branch
        expression: git.branchProtection("main") != null
        identifier: 97cab18c-cd5b-3c66-baf3-4da2291cd022
        weight: 1
        level: Foundational Security
      - title: Data retention policy linked
        expression: links("document").filter((link) => link.name.matches("data-retention*")).length
          > 0
        identifier: 9ebf4ee6-5af6-369b-8bb3-67365be7900f
        weight: 1
        level: Operational Compliance
        failureMessage: "Add a link of type document with a name that starts with data-retention\
          \ by following the instructions in [our docs](https://docs.cortex.io/ingesting-data-into-cortex/entities-overview/entities/external-docs#add-links-to-an-entity)."
      - title: PR approval is required to merge
        expression: git.numOfRequiredApprovals() > 0
        identifier: a148260a-81c3-3201-9692-de99fd08ed16
        weight: 1
        level: Foundational Security
      - title: Vuln scan passing (med & high)
        expression: "snyk.numOfIssues(severity=[\"HIGH\", \"CRITICAL\", \"MEDIUM\"]) <=\
          \ 0"
        identifier: ce7d90a6-fa92-3bfb-9eaf-ab3bb3f1deb3
        weight: 1
        level: Operational Compliance
      - title: Unit testing in place
        expression: |
          git.workflowRuns().filter((run) => run.name.matchesIn("Unit Test")).length > 0
        identifier: e5e9ecd2-683f-3b63-8da9-fdb807fbc736
        weight: 1
        level: Operational Compliance
      - title: "Vuln scan passing (low, med & high)"
        expression: "snyk.numOfIssues(severity=[\"HIGH\", \"CRITICAL\", \"MEDIUM\", \"LOW\"\
          ]) <= 0"
        identifier: f7e0f628-cd94-3f08-aeb9-72b03565c5d7
        weight: 1
        level: Advanced SOC 2 Maturity
      filter:
        kind: GENERIC
        types:
          include:
          - service
      ```
    </Accordion>
  </Tab>
</Tabs>

### Step 2: Review and modify rules

Cortex's templated rules are based on common industry standards:

<AccordionGroup>
  <Accordion title="Level 1: Foundational Security">
    * On-call is set<br />
      `oncall != null`
    * Service has ownership<br />
      `ownership != null`
    * TLS is enabled<br />
      `custom("tls_enabled") == true`
    * Branch protection is set on default branch<br />
      `git.branchProtection("main") != null`
    * PR approval is required to merge<br />
      `git.numOfRequiredApprovals() > 0`
  </Accordion>

  <Accordion title="Level 2: Operational Compliance">
    * Data retention policy linked<br />
      `links("document").filter((link) => link.name.matches("data-retention*")).length > 0`
    * Vulnerability scan passing (medium & high)<br />
      `snyk.numOfIssues(severity=["HIGH", "CRITICAL", "MEDIUM"]) <= 0`
    * Unit testing in place<br />
      `git.workflowRuns().filter((run) => run.name.matchesIn("Unit Test")).length > 0`
  </Accordion>

  <Accordion title="Level 3: Advanced SOC 2 Maturity">
    * Pen test linked<br />
      `links("pen-test").length > 0`
    * Service included in Risk Assessment in last year<br />
      `custom("last_risk_assessment_date").fromNow() > duration("P1Y")`
    * Vulnerability scan passing (low, medium, & high)<br />
      `snyk.numOfIssues(severity=["HIGH", "CRITICAL", "MEDIUM", "LOW"]) <= 0`
  </Accordion>
</AccordionGroup>

You can reorder, delete, and edit rules, add more rules to a level, and assign more points to a rule to signify its importance. Behind each rule is a [Cortex Query Language (CQL) ](/standardize/cql)query; you can edit the existing CQL or write your own queries to further refine your rules.

## Create a SOC 2 Initiative

Follow the steps below to create an Initiative:

<Accordion title="Create a SOC 2 Initiative">
  To motivate change by a certain deadline, you can create an Initiative:

  1. While viewing your SOC 2 Compliance Scorecard, click **Create Initiative** in the upper right.
  2. Configure the Initiative fields, including a descriptive name so your team members understand the purpose of the Initiative. For example, `Ensure data retention policy is linked for all services`.
     * Make sure to enable notifications so users are notified if an entity they own is failing the Initiative's goal.
  3. Save the Initiative.

  After the Initiative is published, entity owners will be notified if their entity is not meeting the goal.

  Learn more about [creating Initiatives in the docs](/improve/initiatives).
</Accordion>

## Measuring success

To understand progress of your Scorecard:

* Ask [Cortex MCP,](/get-started/cortex-ai-assistant/mcp) "How is my SOC 2 Scorecard doing?" The MCP will respond with information on the entities that are failing rules and suggested next steps.
* Review reports: The [Bird's Eye report](/improve/reports/birds-eye) gives insight into how entities are performing against the Scorecard by visualizing the data as a heat map:<br />

  <img src="https://mintcdn.com/cortex-290c0c42/qRY2zZcIyXqFVeCq/guides/images/soc2-birds-eye-1.jpg?fit=max&auto=format&n=qRY2zZcIyXqFVeCq&q=85&s=78551fc1b6ce83a8e17151e294aab64a" alt="The bird's eye report shows Scorecard progress as a heatmap." width="2242" height="884" data-path="guides/images/soc2-birds-eye-1.jpg" />

You can also review your Engineering Intelligence metrics for impact on key engineering metrics, such as:

* **MTTR**: With best practices in place, such as on-call rotation and ownership, you should see faster incident response.
* **Deployment frequency**: Improved governance reduces rework and manual gates. Once baselines are set, you may see deployment frequency increasing.


## Related topics

- [Scorecards](/guides/product-areas/scorecards.md)
- [Initiatives and Action items](/improve/initiatives.md)
- [Cortex AI prompt library](/get-started/cortex-ai-assistant/library.md)