Compliance & Policies

SOC 2 Compliance Progress

28%

SOC 2 Compliance Checklist

Target: January 2026 Last Updated: November 29, 2025 Status: In Progress

Section 1: Security (CC Series - Common Criteria)

1.1 Control Environment

CC1.1 Define organizational structure and reporting lines CC1.2 Document board/management oversight responsibilities CC1.3 Establish code of conduct and ethics policy CC1.4 Define commitment to competence (job descriptions, skills) CC1.5 Document accountability and enforcement mechanisms

Evidence Required:

Organization chart Code of conduct document Job descriptions for key roles Board meeting minutes (security discussions)

1.2 Communication and Information

CC2.1 Document internal communication processes for security CC2.2 Establish external communication channels (customers, vendors) CC2.3 Create security awareness training program CC2.4 Document whistleblower/anonymous reporting procedures

Evidence Required:

Internal security communication policy Security awareness training materials Training completion records External communication templates

1.3 Risk Assessment

CC3.1 Conduct formal risk assessment CC3.2 Identify and document potential threats CC3.3 Assess likelihood and impact of risks CC3.4 Document risk mitigation strategies CC3.5 Establish risk acceptance criteria

Evidence Required:

Risk assessment report Risk register/matrix Risk treatment plan Annual risk review documentation

1.4 Monitoring Activities

CC4.1 Implement continuous monitoring controls CC4.2 Establish security metrics and KPIs CC4.3 Document internal audit procedures CC4.4 Create remediation tracking process

Evidence Required:

Monitoring dashboards/reports Security metrics documentation Internal audit reports Remediation tracking logs

1.5 Control Activities

CC5.1 Document logical access controls CC5.2 Implement physical access controls CC5.3 Establish change management procedures CC5.4 Document vendor management controls

Evidence Required:

Access control policy Physical security documentation Change management policy Vendor security assessments

Section 2: Logical and Physical Access Controls

2.1 Logical Access

Evidence Required:

Authentication policy (implemented in security.js) User provisioning/deprovisioning procedures Access review logs RBAC matrix MFA implementation documentation

2.2 Physical Access

CC6.7 Document data center security (Google Cloud) CC6.8 Obtain cloud provider SOC 2 report CC6.9 Document office physical security (if applicable)

Evidence Required:

Google Cloud SOC 2 report Data center security documentation Physical access logs (if applicable)

Section 3: System Operations

3.1 Infrastructure Security

CC7.1 Implement security headers Content-Security-Policy X-Content-Type-Options X-Frame-Options Referrer-Policy CC7.2 Configure firewall rules CC7.3 Implement intrusion detection/prevention CC7.4 Document network segmentation CC7.5 Implement DDoS protection

Evidence Required:

Security headers implementation Firewall configuration documentation IDS/IPS logs Network architecture diagram

3.2 Vulnerability Management

CC7.6 Conduct vulnerability scans (quarterly minimum) CC7.7 Perform annual penetration testing CC7.8 Document patch management process CC7.9 Track and remediate vulnerabilities

Evidence Required:

Vulnerability scan reports Penetration test report Patch management policy Vulnerability remediation logs

3.3 Security Incident Response

CC7.10 Create incident response plan CC7.11 Define incident severity levels CC7.12 Document escalation procedures CC7.13 Conduct incident response training CC7.14 Test incident response plan (tabletop exercise)

Evidence Required:

Incident response policy Incident response playbooks Training records Tabletop exercise results

Section 4: Change Management

4.1 Development Practices

CC8.1 Document secure development lifecycle (SDLC) CC8.2 Implement code review requirements CC8.3 Conduct security testing in CI/CD pipeline CC8.4 Separate development/staging/production environments CC8.5 Document deployment procedures

Evidence Required:

SDLC documentation Code review logs (GitHub PRs) CI/CD pipeline configuration Environment architecture diagram

4.2 Change Control

CC8.6 Create change request process CC8.7 Document change approval workflow CC8.8 Implement rollback procedures CC8.9 Maintain change log

Evidence Required:

Change management policy Change request tickets Approval records Deployment logs

Section 5: Risk Mitigation

5.1 Business Continuity

CC9.1 Create business continuity plan (BCP) CC9.2 Document disaster recovery procedures CC9.3 Define RTO and RPO objectives CC9.4 Test backup and recovery procedures CC9.5 Document redundancy measures

Evidence Required:

Business continuity plan Disaster recovery plan Backup test results Recovery test documentation

5.2 Vendor Management

CC9.6 Maintain vendor inventory CC9.7 Conduct vendor security assessments CC9.8 Review vendor SOC 2 reports CC9.9 Document vendor contracts with security requirements

Evidence Required:

Vendor inventory list Vendor assessment questionnaires Vendor SOC 2 reports (Google Cloud, Firebase, etc.) Contract security addendums

Section 6: Availability (A Series)

6.1 System Availability

A1.1 Define availability SLAs A1.2 Implement uptime monitoring A1.3 Document capacity planning A1.4 Configure auto-scaling A1.5 Implement health checks

Evidence Required:

SLA documentation Uptime monitoring reports Capacity planning documentation Auto-scaling configuration

6.2 Incident Management

A1.6 Document downtime procedures A1.7 Create status page for customers A1.8 Define communication procedures for outages

Evidence Required:

Incident communication templates Status page (or plan for one) Post-incident review process

Section 7: Processing Integrity (PI Series)

7.1 Data Processing

PI1.1 Document data processing procedures PI1.2 Implement input validation PI1.3 Document output verification PI1.4 Implement error handling

Evidence Required:

Input validation (implemented in security.js) Data processing documentation Error handling logs

7.2 Quality Assurance

PI1.5 Document QA procedures PI1.6 Implement automated testing PI1.7 Document data accuracy controls

Evidence Required:

QA policy Test coverage reports Data validation documentation

Section 8: Confidentiality (C Series)

8.1 Data Classification

C1.1 Create data classification policy C1.2 Identify and label confidential data C1.3 Document handling procedures per classification

Evidence Required:

Data classification policy Data inventory with classifications Handling procedures

8.2 Data Protection

C1.4 Implement encryption in transit (HTTPS) C1.5 Implement encryption at rest C1.6 Document key management procedures C1.7 Implement data masking for sensitive fields

Evidence Required:

TLS/SSL configuration Encryption at rest documentation Key management policy Data masking implementation

8.3 Data Retention

C1.8 Create data retention policy C1.9 Document data disposal procedures C1.10 Implement automated data purging

Evidence Required:

Data retention policy Data disposal procedures Purge logs

Section 9: Privacy (P Series)

9.1 Privacy Notice

P1.1 Create/update privacy policy P1.2 Document data collection practices P1.3 Obtain user consent for data collection P1.4 Document third-party data sharing

Evidence Required:

9.2 Data Subject Rights

P2.1 Implement data access request process P2.2 Implement data deletion request process P2.3 Implement data portability P2.4 Document response timeframes

Evidence Required:

Data subject request procedures Request tracking system Response templates

9.3 Privacy by Design

P3.1 Document privacy impact assessments P3.2 Implement data minimization P3.3 Document purpose limitation

Evidence Required:

Privacy impact assessment template Data minimization documentation

Section 10: Policies & Procedures Status

10.1 Required Policies

10.2 Required Procedures

User Provisioning/Deprovisioning Access Review Procedure Incident Response Playbooks Backup and Recovery Procedure Change Request Procedure Vulnerability Management Procedure Vendor Assessment Procedure

Section 11: Technical Controls

11.1 Application Security

11.2 Infrastructure Security

WAF (Web Application Firewall) DDoS protection Network segmentation Secrets management (not in code) Container security scanning Dependency vulnerability scanning

11.3 Monitoring & Logging

Client-side security logging Server-side access logs Server-side error logs Security event monitoring (SIEM) Log retention (90+ days) Alerting for security events

Section 12: Audit Preparation Timeline

Month 1 (December 2025)

Week 1-2:

Complete risk assessment Finalize all policies Document current state of controls

Week 3-4:

Implement missing technical controls Begin collecting evidence Schedule penetration test

Month 2 (January 2026)

Week 1-2:

Complete penetration test Remediate findings Conduct internal audit

Week 3-4:

Finalize all documentation Prepare evidence packages Auditor kickoff meeting

Next Priority Items

Implement MFA for user accounts
Set up server-side logging (SIEM)
Schedule penetration test
Complete audit preparation timeline tasks
Conduct backup recovery testing
Implement container scanning

Information Security Policy

ID: ISP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This Information Security Policy establishes the framework for protecting Rial Labs' information assets, systems, and data. It defines the security principles, responsibilities, and requirements that govern how we manage and protect sensitive information.

2. Scope

This policy applies to:

All employees, contractors, and third parties with access to Rial Labs systems
All information systems, applications, and infrastructure
All data processed, stored, or transmitted by Rial Labs

3. Information Security Principles

3.1 Confidentiality

Information shall be accessible only to those authorized to have access.

3.2 Integrity

Information shall be accurate and complete, and processing methods shall be valid.

3.3 Availability

Information and associated systems shall be accessible when needed by authorized users.

4. Data Classification

Classification	Description	Examples
Restricted	Highly sensitive data	Customer PII, payment data, credentials
Confidential	Sensitive business info	Source code, business plans
Internal	Internal use only	Policies, procedures
Public	Public release approved	Marketing materials

5. Security Controls

Access granted based on least privilege principle
MFA required for sensitive systems
Data encrypted at rest (AES-256) and in transit (TLS 1.2+)
Backups performed daily and tested monthly
All endpoints have anti-malware protection

6. Compliance

This policy supports compliance with SOC 2 Type II, GDPR, and CCPA requirements.

Acceptable Use Policy

ID: AUP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This policy defines the acceptable use of Rial Labs' IT resources and protects employees and the company from risks associated with inappropriate use.

2. Acceptable Use

Conducting authorized business activities
Professional development and training
Limited personal use that doesn't interfere with work

3. Prohibited Use

Attempting to bypass security controls
Sharing credentials or access tokens
Installing unauthorized software
Accessing inappropriate content
Any activity that violates law

4. Password Requirements

Minimum 12 characters
Enable MFA where available
Never share credentials
Change passwords if compromise suspected

5. Monitoring

Rial Labs reserves the right to monitor all use of IT resources. Users should have no expectation of privacy when using company resources.

Access Control Policy

ID: ACP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This policy establishes requirements for controlling access to systems, applications, and data based on business need and least privilege.

2. Access Control Principles

Least Privilege: Users receive only minimum access necessary
Separation of Duties: Critical functions divided among multiple individuals
Need-to-Know: Access limited to those who require it

3. Authentication Requirements

Requirement	Standard Users	Privileged Users
Min Password Length	12 characters	16 characters
Max Password Age	90 days	60 days
Lockout Threshold	5 attempts	3 attempts

4. MFA Requirements

MFA is required for: privileged access, remote access, production systems, restricted data, cloud consoles, and code repositories.

5. Access Reviews

User access reviewed quarterly
Privileged access reviewed monthly
Third-party access reviewed quarterly

Incident Response Policy

ID: IRP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This policy establishes procedures for detecting, responding to, and recovering from security incidents.

2. Severity Levels

Severity	Response Time	Examples
P1 - Critical	15 minutes	Ransomware, data breach, production down
P2 - High	1 hour	Compromised credentials, phishing
P3 - Medium	4 hours	Malware contained, failed intrusion
P4 - Low	24 hours	Policy violation, suspicious activity

3. Response Phases

Detection: Identify and validate the incident
Containment: Limit scope and preserve evidence
Eradication: Remove the threat
Recovery: Restore systems to normal
Post-Incident: Document lessons learned

4. Contact

Report incidents to: security@riallabs.com

Data Retention Policy

ID: DRP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This policy defines how long different types of data are retained and when they must be securely disposed.

2. Retention Periods

Data Type	Retention Period
Customer account data	Duration of relationship + 7 years
Transaction records	7 years
Security logs	1 year
Employee records	Duration + 7 years
Contracts	Duration + 10 years

3. Data Disposal

Electronic data: Secure erasure or cryptographic destruction
Physical media: Shredding or certified destruction
Cloud data: Verified deletion from all backups

Privacy Policy

ID: PP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Public

1. Information We Collect

Account information (name, email, phone)
Photos and images uploaded to TrueShot
Usage data and analytics
Device and technical information

2. How We Use Information

Provide and improve our services
Process photo verification requests
Communicate about services
Ensure security and prevent fraud

3. Your Rights (GDPR/CCPA)

Access your personal data
Request correction or deletion
Data portability
Opt-out of certain processing

4. Contact

Privacy inquiries: privacy@riallabs.com

Business Continuity Policy

ID: BCP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This policy ensures Rial Labs can continue critical operations during and after a disruptive event.

2. Recovery Objectives

System	RTO	RPO
TrueShot Platform	4 hours	1 hour
Customer Database	4 hours	1 hour
Corporate Systems	24 hours	24 hours

3. Backup Strategy

Daily automated backups
Geographic redundancy
Monthly restoration testing
Encrypted backup storage

4. Testing

BCP is tested annually with tabletop exercises and technical recovery drills.

Change Management Policy

ID: CMP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This policy establishes a structured approach for managing changes to systems and infrastructure.

2. Change Types

Type	Approval	Lead Time
Standard	Pre-approved	None
Normal	Change Manager	3 days
Major	CAB	5 days
Emergency	Emergency approval	Immediate

3. Change Request Requirements

Description and justification
Risk assessment
Implementation and rollback plans
Testing plan

4. Code Review

All code changes require peer review, passing tests, and security scan before deployment.

Vendor Management Policy

ID: VMP-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This policy establishes requirements for selecting, assessing, and managing third-party vendors.

2. Vendor Classification

Tier	Criteria	Assessment
Critical	Access to restricted data	Full assessment, annual review
High	Access to confidential data	Standard assessment, annual review
Medium	Internal data access	Basic assessment, biennial review
Low	No data access	Minimal assessment

3. Security Requirements

Data encryption in transit and at rest
Access controls and authentication
Incident response capabilities
SOC 2 certification (for critical vendors)

Vulnerability Management Procedure

ID: VMP-002 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Purpose

This procedure establishes the process for identifying, assessing, and remediating security vulnerabilities.

2. Severity & SLAs

Severity	CVSS Score	Remediation SLA
Critical	9.0 - 10.0	72 hours
High	7.0 - 8.9	7 days
Medium	4.0 - 6.9	30 days
Low	0.1 - 3.9	90 days

3. Scanning Schedule

Infrastructure scan: Weekly
Dependency scan: Per commit
Container scan: Per build
Penetration test: Annually

Risk Assessment

ID: RA-001 Version: 1.0 Assessment Date: Nov 29, 2025 Classification: Confidential

Key Findings Summary

Risk Level	Count	Requiring Action
Critical	0	0
High	3	3
Medium	8	0
Low	12	0

Top Risks Identified

Lack of MFA on all accounts - High (Score: 16)
Limited server-side logging - High (Score: 16)
No formal penetration testing - High (Score: 12)

Immediate Actions (30 days)

Implement MFA for all accounts - Target: Jan 15, 2026
Deploy comprehensive logging - Target: Jan 31, 2026
Schedule penetration test - Target: Jan 15, 2026

Employee Security Handbook

ID: ESH-001 Version: 1.0 Effective: Dec 1, 2025 Classification: Internal

1. Password Security

Use strong, unique passwords (12+ characters)
Enable MFA on all accounts
Use a password manager
Never share or write down passwords

2. Phishing Awareness

Verify sender email addresses
Hover over links before clicking
Be suspicious of urgent requests
Report suspicious emails to security@riallabs.com

3. Device Security

Keep software updated
Enable full disk encryption
Lock screen when away
Report lost/stolen devices immediately

4. Data Handling

Classify data appropriately
Encrypt sensitive files
Use approved cloud services only
Securely delete when no longer needed

5. Incident Reporting

Report any security concerns immediately to security@riallabs.com or via Slack #security-incidents

SOC 2 Compliance Center

SOC 2 Compliance Progress

SOC 2 Compliance Checklist

Section 1: Security (CC Series - Common Criteria)

1.1 Control Environment

1.2 Communication and Information

1.3 Risk Assessment

1.4 Monitoring Activities

1.5 Control Activities

Section 2: Logical and Physical Access Controls

2.1 Logical Access

2.2 Physical Access

Section 3: System Operations

3.1 Infrastructure Security

3.2 Vulnerability Management

3.3 Security Incident Response

Section 4: Change Management

4.1 Development Practices

4.2 Change Control

Section 5: Risk Mitigation

5.1 Business Continuity

5.2 Vendor Management

Section 6: Availability (A Series)

6.1 System Availability

6.2 Incident Management

Section 7: Processing Integrity (PI Series)

7.1 Data Processing

7.2 Quality Assurance

Section 8: Confidentiality (C Series)

8.1 Data Classification

8.2 Data Protection

8.3 Data Retention

Section 9: Privacy (P Series)

9.1 Privacy Notice

9.2 Data Subject Rights

9.3 Privacy by Design

Section 10: Policies & Procedures Status

10.1 Required Policies

10.2 Required Procedures

Section 11: Technical Controls

11.1 Application Security

11.2 Infrastructure Security

11.3 Monitoring & Logging

Section 12: Audit Preparation Timeline

Month 1 (December 2025)

Month 2 (January 2026)

Next Priority Items

Information Security Policy

1. Purpose

2. Scope

3. Information Security Principles

3.1 Confidentiality

3.2 Integrity

3.3 Availability

4. Data Classification

5. Security Controls

6. Compliance

Acceptable Use Policy

1. Purpose

2. Acceptable Use

3. Prohibited Use

4. Password Requirements

5. Monitoring

Access Control Policy

1. Purpose

2. Access Control Principles

3. Authentication Requirements

4. MFA Requirements

5. Access Reviews

Incident Response Policy

1. Purpose

2. Severity Levels

3. Response Phases

4. Contact

Data Retention Policy

1. Purpose

2. Retention Periods

3. Data Disposal

Privacy Policy

1. Information We Collect