Overview
A payment interface provider serving merchants globally needed SOC 2 Type II certification to unlock enterprise sales. The audit scope covered cloud infrastructure, access controls, incident response, and data handling practices.
Challenge
- No formal security baseline across Kubernetes and cloud environments
- Audit logging was incomplete — key infrastructure events were not captured
- Secrets were stored in environment variables and plaintext config maps
- No documented incident response or change management processes
Solution
Security Infrastructure
- CIS Kubernetes Benchmark compliance across all clusters (scored via kube-bench)
- Pod Security Standards enforced — no privileged containers in production
- Network policies via Cilium: zero-trust east-west traffic between services
- RBAC audit: reduced 47 overprivileged roles to least-privilege configurations
Compliance Automation
- AWS Secrets Manager + External Secrets Operator for all credential management
- CloudTrail + EKS audit logs centralised into OpenSearch with 1-year retention
- Automated CIS drift detection running nightly with Slack alerting
Audit Preparation
- Evidence collection automated for 80% of audit control requirements
- Incident response runbooks authored and tabletop exercises conducted
- Worked with auditor during fieldwork to demonstrate control effectiveness
Results
The client passed their SOC 2 Type II audit with zero critical findings. The certification unlocked three enterprise contracts that had been pending compliance sign-off.