MINUTES · B180F820
IT Security & SOC-2 Compliance Audit
2026-09-23 · 14:00 · chaired by Rachel Dsouza
Approved by Rachel Dsouza on 9/23/2026, 11:00:58 AM
Executive summary
The SOC-2 readiness review confirmed two high-severity access-control findings and one medium incident-response gap. Remediation owners and target dates were agreed for all three items ahead of the external audit.
Attendance
| Name | Role | Presence | Voice |
|---|---|---|---|
| Rachel Dsouza | Compliance Officer | In room | calibrated #1 |
| Michael Tan | IT Manager | In room | calibrated #2 |
| Sofia Alvarez | Security Consultant | Online | not calibrated |
1. Scope of Review
Access control, change management and incident response for the core platform.
2. Findings & Observations
Two high-severity findings on privileged access; change management is broadly compliant.
3. Non-Compliance Register
Three items entered the register: shared admin credentials, stale contractor access, and the untimely incident log review.
4. Remediation Plan
Vault-based credential rotation within 30 days; quarterly access recertification from next month.
5. Decisions
Agreed to adopt quarterly access recertification and vault-based credential rotation.
6. Action Summary
Three remediation actions recorded with owners and target dates.
Discussion points by speaker
- RARachel DsouzaScope of the SOC-2 readiness review
Review covers access control, change management and incident response.
- MIMichael TanAccess-control findings
Shared admin credentials are still used for the legacy deployment server.
- MIMichael TanAccess-control findings
12 contractor accounts were not disabled after contract end dates.
Decision ledger
- Adopt quarterly access recertification starting next month.
- Move all privileged credentials to the vault within 30 days.
Action points
| Action | Owner | Deadline | Status |
|---|---|---|---|
Rotate all privileged credentials into the vault Migrate shared admin credentials to the credential vault and enable individual attribution. | Michael Tan | 2026-10-02 | in progress |
Non-compliance items
- Stale contractor accounts not disabledhigh
12 contractor accounts remained active past contract end dates.
SOC-2 CC6.2Michael TanOVERDUE 2026-09-17 - Shared admin credentials on legacy deployment serverhigh
Credential shared across four engineers; no individual attribution possible.
SOC-2 CC6.1Michael Tan2026-10-02 - Incident log review not performed weeklymedium
The weekly incident-log review was skipped in three of the last eight weeks.
SOC-2 CC7.3Sofia Alvarez2026-10-02
Circulation audit trail
- 9/23/2026, 11:00:14 AMSofia Alvarezdelivered+sofia.alvarez@resend.devsent
- 9/23/2026, 11:00:14 AMMichael Tandelivered+michael.tan@resend.devsent
- 9/23/2026, 11:00:14 AMRachel Dsouzadelivered+rachel.dsouza@resend.devsent
- 9/23/2026, 11:00:14 AMSofia Alvarezdelivered+sofia.alvarez@resend.devsent
- 9/23/2026, 11:00:13 AMMichael Tandelivered+michael.tan@resend.devsent
- 9/23/2026, 11:00:13 AMRachel Dsouzadelivered+rachel.dsouza@resend.devsent
- 9/23/2026, 11:00:13 AMSofia Alvarezdelivered+sofia.alvarez@resend.devsent
- 9/23/2026, 11:00:13 AMMichael Tandelivered+michael.tan@resend.devsent
- 9/23/2026, 11:00:11 AMRachel Dsouzadelivered+rachel.dsouza@resend.devsent
- 9/23/2026, 10:59:25 AMSofia Alvarezdelivered+sofia.alvarez@resend.devfailed
- 9/23/2026, 10:59:25 AMMichael Tandelivered+michael.tan@resend.devfailed
- 9/23/2026, 10:59:25 AMRachel Dsouzadelivered+rachel.dsouza@resend.devfailed
- 9/23/2026, 10:59:23 AMSofia Alvarezdelivered+sofia.alvarez@resend.devfailed
- 9/23/2026, 10:59:23 AMMichael Tandelivered+michael.tan@resend.devfailed
- 9/23/2026, 10:59:23 AMRachel Dsouzadelivered+rachel.dsouza@resend.devfailed
- 9/23/2026, 10:54:07 AMSofia Alvarezdelivered+sofia.alvarez@resend.devfailed
- 9/23/2026, 10:54:07 AMMichael Tandelivered+michael.tan@resend.devfailed
- 9/23/2026, 10:54:07 AMRachel Dsouzadelivered+rachel.dsouza@resend.devfailed
- 9/23/2026, 10:54:07 AMSofia Alvarezdelivered+sofia.alvarez@resend.devfailed
- 9/23/2026, 10:54:07 AMMichael Tandelivered+michael.tan@resend.devfailed
- 9/23/2026, 10:54:07 AMRachel Dsouzadelivered+rachel.dsouza@resend.devfailed
- 9/23/2026, 10:54:07 AMSofia Alvarezdelivered+sofia.alvarez@resend.devfailed
- 9/23/2026, 10:54:07 AMMichael Tandelivered+michael.tan@resend.devfailed
- 9/23/2026, 10:54:07 AMRachel Dsouzadelivered+rachel.dsouza@resend.devsent