/generate-tsc-matrix

description: Generate Trust Service Criteria implementation matrix

SOC 2 TSC Matrix Generator

Generates a comprehensive implementation matrix showing which Trust Service Criteria (TSC) controls are implemented, partially implemented, or not applicable, with mapping to infrastructure components.

Usage

/soc2:generate-tsc-matrix [criteria] [output-format]

Arguments

• `$1` - Criteria (optional): "security", "availability", "confidentiality", "processing-integrity", "privacy", or "all" (default: "security")
• `$2` - Output format (optional): "table", "json", "csv", "markdown" (default: "table")

Examples

# Generate matrix for Security criteria only
/soc2:generate-tsc-matrix security

# All Trust Service Criteria
/soc2:generate-tsc-matrix all table

# Export as CSV for spreadsheet
/soc2:generate-tsc-matrix all csv > tsc-matrix.csv

# JSON output for automation
/soc2:generate-tsc-matrix security json

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SOC 2 TRUST SERVICE CRITERIA IMPLEMENTATION MATRIX
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Organization: [Your Company]
Date: 2025-01-28
Scope: Security (CC1-CC9)
Assessment Type: Type II (12 months)
Period: 2024-01-01 to 2024-12-31

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Total Controls: 92
✓ Implemented: 78 (85%)
⚠ Partially Implemented: 11 (12%)
✗ Not Implemented: 2 (2%)
○ Not Applicable: 1 (1%)

By Category:
  CC1 (Control Environment):        10/11 controls (91%)  ⚠ 1 partial
  CC2 (Communication & Information):  7/8 controls (88%)  ⚠ 1 partial
  CC3 (Risk Assessment):              9/9 controls (100%) ✓ Complete
  CC4 (Monitoring):                   8/9 controls (89%)  ✗ 1 missing
  CC5 (Control Activities):          10/11 controls (91%) ⚠ 1 partial
  CC6 (Logical Access):              12/15 controls (80%) ⚠ 3 partial
  CC7 (System Operations):           13/16 controls (81%) ✗ 1 missing, ⚠ 2 partial
  CC8 (Change Management):            6/8 controls (75%)  ⚠ 2 partial
  CC9 (Risk Mitigation):              3/5 controls (60%)  ⚠ 1 partial, ○ 1 N/A

Readiness for Audit: 85% (Target: 100% before period start)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CC1: CONTROL ENVIRONMENT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

✓ CC1.1 - Organization structure demonstrates commitment
  Status: IMPLEMENTED
  Implementation: Organizational chart with defined security roles
  Evidence: ./docs/org-chart-2024.pdf
  Infrastructure: N/A (organizational control)
  Last Review: 2024-01-15
  Notes: CISO reports to CEO, quarterly board reporting

✓ CC1.2 - Board of directors oversight
  Status: IMPLEMENTED
  Implementation: Quarterly security briefings to board
  Evidence: ./evidence/board-minutes-2024-Q*.pdf
  Infrastructure: N/A (organizational control)
  Last Review: 2024-12-10
  Notes: Board reviews SOC 2 report, approves budget

⚠ CC1.3 - Management establishes structures, reporting lines
  Status: PARTIAL
  Implementation: Security team defined, but no dedicated GRC role
  Evidence: ./docs/security-team-charter.pdf
  Infrastructure: N/A (organizational control)
  Gap: No dedicated compliance officer (shared with legal)
  Remediation: Hire GRC analyst or assign dedicated compliance lead
  Target Date: Q1 2025

✓ CC1.4 - Commitment to competence
  Status: IMPLEMENTED
  Implementation: Annual security training + role-based training
  Evidence: ./evidence/training/security-awareness-2024.csv
  Infrastructure: LMS (Learning Management System)
  Last Review: 2024-12-01
  Notes: 98% completion rate, includes phishing simulations

✓ CC1.5 - Enforces accountability
  Status: IMPLEMENTED
  Implementation: Code of conduct, performance reviews include security
  Evidence: ./policies/code-of-conduct-v2.1.pdf
  Infrastructure: HRIS (PingHR)
  Last Review: 2024-01-01
  Notes: Annual attestation required

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CC6: LOGICAL AND PHYSICAL ACCESS CONTROLS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

✓ CC6.1 - Logical and physical access controls
  Status: IMPLEMENTED
  Implementation: AWS IAM with MFA, quarterly access reviews
  Evidence:
    - ./evidence/iam-users-2024-Q*.json
    - ./evidence/access-reviews/2024-Q*-review.pdf
  Infrastructure:
    - AWS IAM (production account)
    - AWS SSO (workforce identity)
    - Okta (SSO provider)
  Components:
    - IAM users: 47 active
    - IAM roles: 23 (service roles)
    - SSO users: 142 (via Okta federation)
    - MFA enabled: 100%
  Automated Testing: Daily (test-control AC-2)
  Last Review: 2024-12-31
  Notes: Zero shared accounts, automated deprovisioning

✓ CC6.2 - Authorization before access granted
  Status: IMPLEMENTED
  Implementation: Manager approval via Jira Service Desk
  Evidence: ./evidence/access-requests/ (sample 25 tickets)
  Infrastructure:
    - Jira Service Desk (request workflow)
    - AWS IAM (provisioning)
    - Slack (approval notifications)
  Process Flow:
    1. User requests access via Jira
    2. Manager approves (Slack notification)
    3. IT provisions (Terraform apply)
    4. Confirmation sent to user
  Automated Testing: Weekly (test approval workflow)
  Last Review: 2024-12-15
  Notes: Average approval time: 4.2 hours

⚠ CC6.3 - Privileges restricted to authorized users
  Status: PARTIAL
  Implementation: RBAC implemented, but 5 users with overly broad permissions
  Evidence: ./evidence/iam-permissions-audit-2024-12.json
  Infrastructure: AWS IAM
  Gap: 5 users with PowerUserAccess (should use job-specific policies)
  Users Affected:
    - john.doe@company.com (DevOps, needs EC2/RDS only)
    - jane.smith@company.com (Data team, needs S3/Athena only)
    - ... 3 more
  Remediation: Create custom policies, transition users
  Target Date: 2025-02-01
  Risk: Medium (users have more access than needed)

✓ CC6.4 - Removal of access timely
  Status: IMPLEMENTED
  Implementation: Automated d