feat/sec-base

SoA N-A tally wrong: 10 controls excluded, header and exclusion summary claim 9

docs/compliance/statement-of-applicability.md:11

7.1-7.6(6)+7.8(1)+7.11-7.13(3)=10. ISO has 93 controls; 83 applicable/10 N-A. Fix header and line 128 exclusion summary.

SOC 2 system description understates CFE secret access surface (payment-status Lambda missing)

docs/compliance/soc2-system-description.md:63

Payment-status Lambda (lambda.stack.ts:640-649) holds GetSecretValue on batu/{env}/cfe/* but is absent from both the system description and cfe-credential-data-flow.md section 7.

R-8 links A.5.22 (Supplier monitoring) to an availability risk — wrong ISO control

docs/compliance/risk-register.md:23

SOC 2 Type II milestone conflict: compliance.md says M11, security-objectives.md says M12

docs/compliance/security-objectives.md:23

Payment-status Lambda missing from CFE GetSecretValue grantee list in data-flow doc

docs/compliance/cfe-credential-data-flow.md:61

[3b SESSION CACHE] in lifecycle diagram has no corresponding prose subsection

docs/compliance/cfe-credential-data-flow.md:17

ISO Stage 2 milestone ambiguity: compliance.md M9 vs security-objectives.md 'cert ~M10'

docs/compliance/security-objectives.md:23

SOC 2 system description presents unperformed controls as operating (pentest + restore tests)

docs/compliance/soc2-system-description.md:74

Lines 74 and 80 list 'annual third-party penetration test' and 'quarterly restore tests' as current controls. compliance.md verified: neither exists. Fix by adding 'planned, first test pending' qualifiers.

SOC 2 system description implies MFA/SSO enforcement is complete

docs/compliance/soc2-system-description.md:77

MFA enforcement is open-item #3 in compliance.md; SoA 5.17 marks it partial. contacto@ still active. Fix: 'SSO via Google Workspace; MFA enforcement rollout in progress'.

SOC 2 system description implies GuardDuty covers all environments — unverified (BAT-261 open)

docs/compliance/soc2-system-description.md:75

GuardDuty live in management only; dev/stg/prod member status unverified. Fix: qualify with '(management account; member coverage pending BAT-261)'.

F-4 severity understated: unsalted SHA-256 enables offline dictionary attack on CFE passwords

docs/compliance/cfe-credential-data-flow.md:71

Vercel service user holds DeleteSecret on CFE path — not flagged as finding

docs/compliance/cfe-credential-data-flow.md:61

Client names (arsient, banorte) in auditor-facing scope statement

docs/compliance/scope-statement.md:62

AWS account IDs in plaintext in auditor-facing compliance docs

docs/compliance/scope-statement.md:23

Notion token incident lacks post-mortem chain for auditors

.claude/rules/compliance.md:64

cfe-credential-data-flow.md: prose jumps §5→§7, skipping §6 Deletion entirely

docs/compliance/cfe-credential-data-flow.md:60

compliance.md open items concatenated inline — won't render as numbered list on GitHub

.claude/rules/compliance.md:58

security-objectives.md O-2: measurement tool references unbuilt status page

docs/compliance/security-objectives.md:16

SoA 5.21: pinned Actions review not linked to a Linear issue

docs/compliance/statement-of-applicability.md:37

scope-statement.md references Vendor Policy without 'draft' qualifier

docs/compliance/scope-statement.md:46

SoA 5.23 marked ✅ but evidence is 'to collect' — contradiction

docs/compliance/statement-of-applicability.md:39

credentials.contract.ts:35-44 citation points to Zod schema, not route definitions

docs/compliance/cfe-credential-data-flow.md:40

No CI check validates compliance doc citations against current code paths

docs/compliance/cfe-credential-data-flow.md:6

O-6 overstates db:verify-rls as running on every PR (conditional on schema changes)

docs/compliance/security-objectives.md:20

No Confidentiality TSC core risk: bill/PII breach missing from register

docs/compliance/risk-register.md:14

No risk covers unauthorized disclosure of customer bills (PDF/XML/line items) or PII. R-1 covers credentials, R-3 covers cross-tenant leakage only. Add explicit bill/PII breach risk.

No LFPDPPP regulatory compliance risk in register

docs/compliance/risk-register.md:14

No Stripe-related risk despite Stripe being in scope

docs/compliance/risk-register.md:14

F-4 remediation (BAT-257) not linked in findings table

docs/compliance/cfe-credential-data-flow.md:75

R-12 (AI agent risk) should cross-reference R-5 (AdminAccess CI roles dependency)

docs/compliance/risk-register.md:27

Stripe CSOC enumeration incomplete in SOC 2 system description

docs/compliance/soc2-system-description.md:85