Jake Lawrence · Information Security / Compliance / Software Operations · AI Systems theme
A SOC 2 self-assessment of a platform run by one person, graded twice: for design, the Type I question, and for operation, the Type II question. The controls that drop a grade between the two are mostly jobs that were built and then switched off.
Twenty-three controls across all five Trust Services Categories (security, availability, confidentiality, processing integrity and privacy), each stated in plain words, tied to the files in this repository that implement it, and graded for design and for operation. The operating grades fall wherever a control was built, tested and then paused, most sharply the encrypted backup with its restore test, which has not run since a spending freeze. A separate section names the criteria one person cannot satisfy alone: separation of duties, access review, and the people controls. The citations are tested on every change, a test fails if a paused job starts running without its grade being raised, and the assessment expires on a review date the build enforces. Scope toggles and a downloadable worksheet make it reusable. Not an audit, and not a claim of compliance.
The acceptable-use policy and the SOC 2 self-assessment cite the same code as evidence: the spend brake, the credential ledger, the tests that run on every change. The policy says what a small organization should do; the assessment grades whether one platform actually keeps doing it.
The Case Study Library shows how this site's controls were built, pull request by pull request. The SOC 2 self-assessment asks the auditor's next question: whether those controls kept running after they merged.
This is field data, not commentary: dated, sourced, and versioned. Subscribe and the next release, correction or new thread reaches you when it lands. It is the one list for the whole site, so you will get the rest of the work too. No schedule, easy out.
Back to the release table · See it on the network · Machine-readable catalog
I design and ship AI tools, full-stack apps, and data pipelines — end to end, to production. Tell me the problem in a sentence; I'll give you an honest read on fit within a day.
Work with me →