SOC 2 readiness for open-source projects on a zero budget

SOC 2 audits are often portrayed as a costly endeavor, involving a compliance vendor, policy consultants, and surveillance tools. However, small open-source projects frequently assume the trust signal is too expensive to pursue, often overlooking the importance of readiness. This post argues that readiness can be achieved without breaking the bank, presenting a framework called P31.

The foundation of P31 is an evidence collector, which systematically gathers data from the repository, including timestamps, test runs, deployment logs, and dependency information. This data is then compiled into a controls-index.json file, establishing a direct link between the collected evidence and the Security Technical Committee (STC).

When auditors inquire about access controls, the answer lies in this file rather than a chaotic search for documentation. Alongside the evidence collector, a Software Bill of Materials (SBOM) is generated using scripts/sbom.mjs, which produces a CycloneDX 1.5 SBOM from the project's lockfiles. This SBOM provides a machine-readable and up-to-date view of the project's dependencies, addressing another crucial aspect of SOC 2 readiness.

The Trust Center serves as the third pillar in this framework. It is a publicly accessible webpage that addresses the ten most common questions customers have before committing to a project. Topics covered include data residency, retention, encryption, access controls, incident response, and compliance status. Essentially, the Trust Center functions as a documentation artifact, answering customer inquiries without requiring a costly SaaS product.

The final pillar is signing, where the P31 framework employs an in-house dual signing scheme consisting of ML-DSA-65 (FIPS 204) and Ed25519. This signing process is facilitated by the p31-crypto module, ensuring that released artifacts bear a post-quantum trust anchor without incurring licensing fees for a signing service. However, it is important to note that while this approach gets projects SOC 2-ready, it does not certify them.

Formal SOC 2 attestation still requires the services of a licensed auditor. Yet, by following the P31 framework, projects enter the SOC 2 attestation process with a solid foundation: evidence, an SBOM, a Trust Center, and a signing strategy. This preparedness position is significantly more advantageous than a project that forgoes the preparation process due to the misconception that compliance demands a budget.