Good afternoon, Chandra

Acme Robotics is 84% audit-ready across 3 frameworks · last scan 6 min ago

Framework readinessView all →

ISO 2700187 / 93 controls

SOC 2Type II · 62 / 72

HIPAA39 / 54 safeguards

UPCOMING AUDIT

SOC 2 Type II — Fieldwork

Northgate Assurance LLP · Nov 30, 2026

40

days

10

open items

3

samples due

Control health · 90 days▲ 12%

━ Passing 184┅ Failing 7Needs evidence 12

Integration healthManage →

AWS

AWS (3)

Synced 6m ago

OK

AZ

Azure

Synced 12m ago

OK

GCP

Google Cloud

Synced 1h ago

OK

GW

Workspace

Token expiring

4d

GH

GitHub

Rate limited

Retry

AG

Device agent

142 / 148

OK

Failing tests needing attentionSee all 7 →

Test	Source	Frameworks	Owner	Status
MFA enforced for all GitHub org members	GitHub	ISO A.5.17SOC CC6.1	Priya N.	3 users
S3 buckets block public access	AWS prod	ISO A.8.3HIPAA 164.312	Marcus L.	1 bucket

Controls

203 controls · one control satisfies requirements across all your frameworks

All 203Failing 7Needs evidence 12Assigned to me 18

ID	Control	Mapped to	Tests	Owner	Status
AC-04	Quarterly user access reviews	ISOSOC 2HIPAA	3/4	Priya N.	Due soon
AC-07	MFA required for all workforce accounts	ISOSOC 2HIPAA	4/5	Priya N.	Failing
CR-02	Encryption at rest for production data	ISOSOC 2HIPAA	6/6	Marcus L.	Passing
CM-11	Code changes peer-reviewed before merge	ISOSOC 2	2/2	Dev T.	Passing
EP-03	Laptop disk encryption enabled	ISOHIPAA	1/1	IT Ops	Passing
VM-05	Vendor security reviews annually	ISOSOC 2	—	Lena K.	Manual
BC-01	Backups tested via restore quarterly	ISOSOC 2HIPAA	2/2	Marcus L.	Passing
IR-02	Incident response plan tested yearly	ISOSOC 2HIPAA	—	Chandra V.	Needs evidence
HR-06	Security awareness training completed	ISOSOC 2HIPAA	1/1	People Ops	Passing
LG-03	Audit logs retained ≥ 1 year	ISOSOC 2	3/3	Marcus L.	Passing

Evidence library

2,418 items · every file SHA-256 hashed at collection and stored write-once

Integrity verified

100%

Chain intact · anchored 02:00

Automated

2,207

91% of total

Manual uploads

211

PHI scan on upload

Retention policy

6 years

HIPAA tenant default

Evidence	Control	Source	Collected	Integrity	Lock
IAM credential report — prod sha256 9f2c…a41e	AC-07	AWS AWS collector v2.4	Oct 21, 12:47 PM CT	SHA-256 verified	🔒 Oct 21, 2032
Q3 access review — signed.pdf sha256 41bd…07c3	AC-04	Manual · Priya N.	Oct 3, 9:12 AM CT	SHA-256 verified	🔒 Oct 3, 2032
Branch protection rules — 41 repos sha256 c07a…9be2	CM-11	GH GitHub collector v1.9	Oct 21, 11:30 AM CT	SHA-256 verified	🔒 Oct 21, 2032
Disk encryption — 142 devices sha256 e5d1…33f0	EP-03	Device agent 1.3.0	Oct 21, 8:00 AM CT	SHA-256 verified	🔒 Oct 21, 2032
Restore test log — db-primary sha256 77ae…d2b9	BC-01	AZ Azure collector v2.1	Oct 14, 3:05 AM CT	SHA-256 verified	🔒 Oct 14, 2032
Calibration cert — CMM line 2.jpg sha256 —	QM-08	Manual · Plant floor	Oct 21, 12:51 PM CT	Hashing…	Pending
Training completion export sha256 b3c9…1f6a	HR-06	GW Workspace v1.2	Oct 20, 6:00 PM CT	SHA-256 verified	🔒 Oct 20, 2032

SOC 2 Type II audit

Fieldwork in progress · 72 controls in scope

Controls tested

48 / 72

Sample requests

14 · 3 open

Findings

2 · 1 exception

Under review

Avg. response time

6.2 h

▼ 70% vs last year

Sampling requests

Request	Population	Due	Status
REQ-14 · New-hire onboarding Sample 5 of 23 hires	HR system	Oct 24	Open
REQ-13 · Change tickets Sample 25 of 612 PRs	GitHub	Oct 23	Submitted
REQ-12 · Terminations Sample 4 of 9 leavers	Workspace	Oct 22	Open
REQ-11 · Q2 access review Full population	Manual	Oct 18	Accepted
REQ-10 · Backup restores Sample 2 of 6	Azure	Oct 16	Accepted

Findings

F-02 · MFA gapException

3 GitHub accounts lacked MFA for 11 days in July. CC6.1

Management response drafted · Priya N.

F-01 · Late access reviewObservation

Q2 review completed 9 days after due date. CC6.2

Remediated · evidence REQ-11