Hugging Face's logo

shaikhsalman
/
devsecops-platform

devsecops
llm
sft
lora
tulu-3
kubernetes
terraform
Model card Files
xet
 Community
devsecops-platform
File size: 3,161 Bytes
7c19d46
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
# =============================================================================
# SOC2 Type II Compliance Controls Mapping
# =============================================================================
# Maps platform components to SOC2 trust service criteria

controls:
  # --- CC6: Security ---
  CC6.1:
    description: "Logical and physical access controls"
    implemented_by:
      - terraform/modules/iam  # IAM roles with MFA requirement
      - terraform/modules/vpc  # VPC isolation, flow logs
      - k8s/base/rbac          # Kubernetes RBAC
      - k8s/base/network-policies  # Network segmentation
    evidence:
      - IAM access logs (CloudTrail)
      - VPC flow logs (S3)
      - RBAC audit logs (EKS)

  CC6.2:
    description: "Authentication and authorization"
    implemented_by:
      - k8s/manifests/external-secrets  # OIDC-based secret access
      - terraform/modules/iam            # MFA enforcement
    evidence:
      - OIDC token audit logs
      - MFA configuration records

  CC6.3:
    description: "Encryption of data at rest"
    implemented_by:
      - terraform/modules/kms  # KMS key rotation
      - terraform/modules/rds  # RDS encryption
      - terraform/modules/s3   # S3 SSE-KMS
      - k8s/manifests/external-secrets  # EKS secret encryption
    evidence:
      - KMS key rotation logs
      - RDS encryption config
      - S3 bucket policies

  CC6.6:
    description: "Encryption of data in transit"
    implemented_by:
      - k8s/manifests/istio         # mTLS enforcement
      - k8s/manifests/cert-manager   # TLS cert automation
    evidence:
      - mTLS policy (PeerAuthentication)
      - Certificate issuance logs

  CC6.8:
    description: "Vulnerability management"
    implemented_by:
      - k8s/manifests/trivy-operator  # Continuous scanning
      - security/trivy                # Image scanning
      - ci-cd/github-actions          # Pipeline scanning
    evidence:
      - Trivy scan reports
      - CVE remediation SLA tracking

  # --- CC7: Availability ---
  CC7.1:
    description: "System availability monitoring"
    implemented_by:
      - monitoring/prometheus   # Alerting rules
      - monitoring/grafana      # Dashboards
      - monitoring/otel         # Distributed tracing
    evidence:
      - Uptime SLO reports
      - Incident post-mortems

  CC7.2:
    description: "Disaster recovery"
    implemented_by:
      - terraform/modules/rds  # Multi-AZ RDS
      - terraform/modules/eks  # Multi-AZ EKS
    evidence:
      - DR test results (quarterly)
      - RTO/RPO measurements

  # --- CC8: Processing Integrity ---
  CC8.1:
    description: "Change management"
    implemented_by:
      - k8s/manifests/argo-cd    # GitOps deployments
      - ci-cd/github-actions      # CI/CD pipeline
    evidence:
      - PR approval records
      - Deployment audit trail

  # --- CC9: Confidentiality ---
  CC9.1:
    description: "Data classification and handling"
    implemented_by:
      - k8s/manifests/external-secrets  # Secrets management
      - k8s/manifests/kyverno           # Policy enforcement
    evidence:
      - Data classification policy
      - Secret rotation logs