feat/sec-base

CA-002 source cites F-1 only; BAT-256 corrective action covers F-1 and F-2

docs/compliance/corrective-action-register.md

F-2 (no customer DELETE endpoint) is a separate HIGH finding. Update Source to '(F-1, F-2)'.

F-6 / BAT-258 (log redaction) has no CA register entry

docs/compliance/corrective-action-register.md

Known Medium finding with a filed Linear issue and no CA row. Add CA-006.

Webshare/IPRoyal T3 classification not yet verified against own tiering definition

docs/compliance/vendor-register.md

Tiering definition: T1 = Restricted/Confidential data. Register flags the caveat but leaves it unresolved. Confirm T3 or upgrade before merge.

Evidence index claims CloudTrail secret-read events are live evidence — they are not enabled

docs/compliance/evidence-index.md

The IR tabletop explicitly pre-identifies CloudTrail GetSecretValue data events as a gap. The evidence index row for 'Secrets handling (CC6.1 / A.8.24)' cites these events as current evidence — misrepresenting control state to an auditor.

Webshare/IPRoyal T3 tier understates actual risk: plaintext CFE credentials transit the proxy

docs/compliance/vendor-register.md

Implementation routes loginMiEspacio() through the residential proxy. The compensating-control note ('session transport only') is inaccurate — username+password POST transits the proxy IP. T3 classification is premature pending verification or upgrade.

Pentest RFQ should explicitly scope GitHub Actions / OIDC role abuse path (CA-004 HIGH)

docs/compliance/pentest-rfq.md

Most realistic path to mass CFE credential exfiltration. Add: 'GitHub Actions workflow injection / OIDC deployer role escalation to Secrets Manager.'

IR tabletop misses the value-exfiltration inject variant

docs/compliance/ir-tabletop-cfe-credential-leak.md

Scenario starts at lowest-severity ARN-in-log variant. Add T+15 inject where CloudTrail shows anomalous GetSecretValue from unexpected principal.

Anthropic T2 annotation understates agent context scope

docs/compliance/vendor-register.md

Agents receive IaC details, compliance docs, open findings, partial detector IDs. Annotation should explicitly acknowledge and confirm DPA status.

pentest-rfq.md collapses Status into Owner row

docs/compliance/pentest-rfq.md

All other docs have a separate | Status | row. Split into two rows for consistency.

evidence-index.md missing IR management controls row (A.5.24-28 / CC7.3-CC7.5)

docs/compliance/evidence-index.md

ir-tabletop doc cites these controls but the evidence index has no corresponding entry mapping them to the tabletop artifact.

CA register missing data-flow findings F-3, F-5, and F-6

docs/compliance/corrective-action-register.md

cfe-credential-data-flow.md identified 6 findings. CA register only maps F-1, F-4, plus infra gaps. F-3 (SFN execution history), F-5 (member RLS read), and F-6 (log redaction, BAT-258) have no CA rows. ISO Clause 10.1 requires every identified nonconformity to have a register entry.

Control calendar has no privileged-access review cadence

docs/compliance/control-calendar.md

Quarterly access review covers all identities but does not distinguish privileged access (AWS IAM admin, GitHub org owners). CC6.2/A.5.18 prompt auditors to look for a separate privileged-access cadence, especially given CA-004 (OIDC roles hold AdministratorAccess).

Evidence index missing CC9 (risk mitigation/transfer) and CC5/CC1 TSC criteria

docs/compliance/evidence-index.md

No evidence plan for CC9 (cyber insurance, vendor liability clauses) or CC1.1-CC1.5 (control environment/tone-at-top as distinct TSC criteria). SOC 2 Type II auditors sample by TSC criterion.

IR tabletop has one scenario; no future scenarios enumerated

docs/compliance/ir-tabletop-cfe-credential-leak.md

Year-2 SOC 2 auditors will look for scenario diversity. Add a future-scenarios placeholder list.

Internal audit checklist missing Clause 9.1 (monitoring, measurement)

docs/compliance/internal-audit-programme.md

Commonly cited as separate Stage 2 nonconformity. Add checklist item for 9.1 monitoring methods.

Vendor register missing transactional email provider

docs/compliance/vendor-register.md

Email service transfers customer PII — must appear in register and subprocessor list.

Control calendar backup owners missing for 3 of 4 quarterly controls

docs/compliance/control-calendar.md

For a 3-founder team, empty backup fields mean missed control slots become audit exceptions.

Audit RFQ facts pack missing data-residency and BC/DR claims

docs/compliance/audit-rfq.md

Firms ask upfront; answering saves ~1 week of back-and-forth before quotes arrive.

Platform evaluation Fedora agent step lacks a pass/fail definition

docs/compliance/platform-evaluation.md

25%-weighted criterion will be scored inconsistently without a binary pass definition.

Vendor register Action ③ (subprocessor list publish) needs a Linear issue

docs/compliance/vendor-register.md

C1 requirement for Type II. The initial publish needs a ticket with a target date before the window opens.