Build a Control Matrix

Pro

Map each Annex A or TSC criterion to the actual control, owner, test method, and frequency.

Company brief

Northbeam Analytics

SaaS · North America

Description

Series-B observability platform with 180 employees, mostly remote engineers, processing customer telemetry in AWS.

Analyst task

You joined as the lead GRC analyst last month. Produce a 90-day plan that addresses the most material audit findings, stands up a vendor risk program, and gets the org to its first SOC 2 Type I readiness assessment.

Systems

AWS multi-account
Postgres (RDS)
Internal auth via OIDC
Customer-facing dashboard

Regulatory exposure

SOC 2 (committed to enterprise deals)
State breach notification laws (US)

Top risks

Misconfigured S3 bucket
Insider threat via admin console
Vendor (datadog) concentration
Oncall burnout

Audit concerns

CC6.1 access reviews evidence
CC7.2 monitoring completeness
Vendor SOC 2 currency

Write your answer

Pro

Loading lab…