Enterprise Security & Compliance | Bootspring Docs

The Enterprise Security workflow guides you through achieving and maintaining security compliance required for enterprise customers, including SOC 2, GDPR, and handling security assessments.

Overview#

Property	Value
Phases	4
Tier	Business
Typical Duration	3-6 months (SOC 2), ongoing
Best For	B2B SaaS, regulated industries, enterprise sales

Why Security Compliance Matters#

Enterprise customers require security compliance for several reasons:

Risk management - They need assurance you won't compromise their data
Regulatory requirements - Many are subject to regulations that extend to vendors
Procurement policy - Security review is often mandatory for vendor approval
Due diligence - Investors and acquirers expect security maturity

Without compliance, you'll face:

Longer sales cycles (security review bottleneck)
Lost deals to compliant competitors
Excluded from RFPs requiring certification
Higher insurance premiums

Compliance Landscape#

┌─────────────────────────────────────────────────────────────────────────┐
│                     COMPLIANCE REQUIREMENTS MAP                         │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                         │
│  SOC 2                    GDPR                    HIPAA                 │
│  ├─ Security              ├─ Lawful basis         ├─ PHI handling       │
│  ├─ Availability          ├─ Data rights          ├─ Access controls    │
│  ├─ Processing integrity  ├─ Breach notification  ├─ Audit controls     │
│  ├─ Confidentiality       ├─ DPA required         ├─ Encryption         │
│  └─ Privacy               └─ Privacy by design    └─ BAA required       │
│                                                                         │
│  ISO 27001                PCI DSS                 CCPA                  │
│  ├─ ISMS framework        ├─ Card data handling   ├─ Consumer rights    │
│  ├─ Risk assessment       ├─ Network security     ├─ Data selling       │
│  ├─ Policy controls       ├─ Encryption           ├─ Opt-out            │
│  └─ Continuous improve    └─ Regular testing      └─ Privacy notice     │
│                                                                         │
├─────────────────────────────────────────────────────────────────────────┤
│ RECOMMENDATION FOR B2B SAAS:                                            │
│ Start with SOC 2 Type II + GDPR compliance                             │
│ Add HIPAA/PCI only if handling health/payment data                      │
└─────────────────────────────────────────────────────────────────────────┘

Phases#

Phase 1: Gap Assessment (2-4 weeks)#

Agents: security-expert, architecture-expert

Assess current security posture against compliance requirements.

Tasks:

Review current security controls
Identify gaps against SOC 2 Trust Service Criteria
Assess GDPR compliance requirements
Document current policies and procedures
Create remediation roadmap

SOC 2 Gap Assessment Checklist:

## SOC 2 Trust Service Criteria - Gap Assessment

### CC - Common Criteria (Security)

#### CC1 - Control Environment
- [ ] Security policies documented and communicated
- [ ] Organizational structure with clear responsibilities
- [ ] Board/management oversight of security
- [ ] Commitment to ethics and integrity

#### CC2 - Communication and Information
- [ ] Information security policy communicated
- [ ] Security training provided to employees
- [ ] External communication of security commitments
- [ ] Incident reporting mechanisms in place

#### CC3 - Risk Assessment
- [ ] Risk assessment process documented
- [ ] Regular risk assessments conducted
- [ ] Risks prioritized and tracked
- [ ] Changes assessed for risk impact

#### CC4 - Monitoring Activities
- [ ] Continuous monitoring implemented
- [ ] Deficiencies identified and remediated
- [ ] Internal audit function exists
- [ ] Security metrics tracked

#### CC5 - Control Activities
- [ ] Access controls implemented
- [ ] Technology controls deployed
- [ ] Policies implemented through technology
- [ ] Segregation of duties enforced

#### CC6 - Logical and Physical Access
- [ ] Authentication mechanisms (MFA)
- [ ] Authorization matrix defined
- [ ] Access reviews conducted
- [ ] Physical security controls

#### CC7 - System Operations
- [ ] Vulnerability management process
- [ ] Incident management process
- [ ] Business continuity planning
- [ ] Change management process

#### CC8 - Change Management
- [ ] Change management policy
- [ ] Testing before deployment
- [ ] Approval workflows
- [ ] Rollback procedures

#### CC9 - Risk Mitigation
- [ ] Vendor management process
- [ ] Vendor security assessments
- [ ] Contractual obligations enforced
- [ ] Business recovery planning

Gap Analysis Template:

// lib/compliance/gap-assessment.ts

interface ControlAssessment {
  controlId: string;
  description: string;
  status: 'compliant' | 'partial' | 'non-compliant' | 'not-applicable';
  currentState: string;
  gap: string;
  remediation: string;
  effort: 'low' | 'medium' | 'high';
  priority: 'critical' | 'high' | 'medium' | 'low';
  owner: string;
  targetDate: Date;
}

const assessmentResults: ControlAssessment[] = [
  {
    controlId: "CC6.1",
    description: "Logical access security",
    status: "partial",
    currentState: "Basic password authentication, no MFA",
    gap: "Multi-factor authentication not enforced",
    remediation: "Implement MFA for all user accounts using TOTP",
    effort: "medium",
    priority: "critical",
    owner: "Security Team",
    targetDate: new Date("2024-04-01")
  },
  {
    controlId: "CC7.2",
    description: "Vulnerability management",
    status: "non-compliant",
    currentState: "Ad-hoc vulnerability scanning",
    gap: "No regular scanning schedule or tracking",
    remediation: "Implement continuous vulnerability scanning with Snyk",
    effort: "low",
    priority: "high",
    owner: "DevOps Team",
    targetDate: new Date("2024-03-15")
  }
  // ... more assessments
];

Phase 2: Remediation (6-12 weeks)#

Agents: security-expert, backend-expert, devops-expert

Implement controls and fixes identified in the gap assessment.

Tasks:

Implement technical controls
Create and update policies
Deploy security tooling
Train employees
Document all controls

Security Controls Implementation:

// middleware.ts - Security Headers

import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  const response = NextResponse.next();

  // Security headers (required for compliance)
  const headers = {
    // Prevent clickjacking
    'X-Frame-Options': 'DENY',

    // Prevent MIME sniffing
    'X-Content-Type-Options': 'nosniff',

    // XSS protection
    'X-XSS-Protection': '1; mode=block',

    // Referrer policy
    'Referrer-Policy': 'strict-origin-when-cross-origin',

    // Content Security Policy
    'Content-Security-Policy': [
      "default-src 'self'",
      "script-src 'self' 'unsafe-inline' 'unsafe-eval'",
      "style-src 'self' 'unsafe-inline'",
      "img-src 'self' data: https:",
      "font-src 'self'",
      "connect-src 'self' https://api.example.com",
      "frame-ancestors 'none'",
      "base-uri 'self'",
      "form-action 'self'"
    ].join('; '),

    // HSTS
    'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',

    // Permissions Policy
    'Permissions-Policy': [
      'camera=()',
      'microphone=()',
      'geolocation=()',
      'interest-cohort=()'
    ].join(', ')
  };

  Object.entries(headers).forEach(([key, value]) => {
    response.headers.set(key, value);
  });

  return response;
}

Audit Logging for Compliance:

// lib/audit/compliance-logger.ts

import { PrismaClient } from '@prisma/client';

const prisma = new PrismaClient();

export interface AuditLogEntry {
  timestamp: Date;
  eventType: string;
  actor: {
    userId: string;
    email: string;
    role: string;
    ipAddress: string;
    userAgent: string;
  };
  resource: {
    type: string;
    id: string;
  };
  action: string;
  outcome: 'success' | 'failure';
  details: Record<string, unknown>;
}

export async function logSecurityEvent(entry: AuditLogEntry): Promise<void> {
  // Write to immutable audit log
  await prisma.auditLog.create({
    data: {
      timestamp: entry.timestamp,
      eventType: entry.eventType,
      actorUserId: entry.actor.userId,
      actorEmail: entry.actor.email,
      actorRole: entry.actor.role,
      actorIp: entry.actor.ipAddress,
      actorUserAgent: entry.actor.userAgent,
      resourceType: entry.resource.type,
      resourceId: entry.resource.id,
      action: entry.action,
      outcome: entry.outcome,
      details: entry.details,
      // Hash for tamper detection
      integrityHash: computeHash(entry)
    }
  });

  // Alert on suspicious activity
  if (shouldAlert(entry)) {
    await sendSecurityAlert(entry);
  }
}

// Required security events to log
const REQUIRED_EVENTS = [
  'user.login',
  'user.logout',
  'user.login_failed',
  'user.password_change',
  'user.mfa_enabled',
  'user.mfa_disabled',
  'user.created',
  'user.deleted',
  'permission.granted',
  'permission.revoked',
  'data.export',
  'data.deletion',
  'api_key.created',
  'api_key.revoked',
  'settings.changed',
  'admin.action'
];

Data Protection Implementation:

// lib/security/encryption.ts

import { createCipheriv, createDecipheriv, randomBytes, scrypt } from 'crypto';
import { promisify } from 'util';

const scryptAsync = promisify(scrypt);

// Encryption for sensitive fields (PII, etc.)
export async function encryptField(
  plaintext: string,
  purpose: string
): Promise<string> {
  const iv = randomBytes(16);
  const key = await deriveKey(purpose);
  const cipher = createCipheriv('aes-256-gcm', key, iv);

  const encrypted = Buffer.concat([
    cipher.update(plaintext, 'utf8'),
    cipher.final()
  ]);

  const authTag = cipher.getAuthTag();

  // Format: iv:authTag:ciphertext (all base64)
  return [
    iv.toString('base64'),
    authTag.toString('base64'),
    encrypted.toString('base64')
  ].join(':');
}

export async function decryptField(
  ciphertext: string,
  purpose: string
): Promise<string> {
  const [ivB64, authTagB64, encryptedB64] = ciphertext.split(':');

  const iv = Buffer.from(ivB64, 'base64');
  const authTag = Buffer.from(authTagB64, 'base64');
  const encrypted = Buffer.from(encryptedB64, 'base64');

  const key = await deriveKey(purpose);
  const decipher = createDecipheriv('aes-256-gcm', key, iv);
  decipher.setAuthTag(authTag);

  return decipher.update(encrypted) + decipher.final('utf8');
}

async function deriveKey(purpose: string): Promise<Buffer> {
  const masterKey = process.env.ENCRYPTION_MASTER_KEY!;
  return await scryptAsync(masterKey, purpose, 32) as Buffer;
}

Phase 3: SOC 2 Audit (4-8 weeks)#

Agents: security-expert

Work with an auditor to complete SOC 2 Type II certification.

Tasks:

Select SOC 2 auditor
Prepare evidence documentation
Complete readiness assessment
Address auditor findings
Obtain report

SOC 2 Evidence Preparation:

## Evidence Collection Guide

### CC6 - Logical and Physical Access Controls

#### CC6.1 - Logical Access Security
Evidence needed:
- [ ] Access control policy document
- [ ] User provisioning procedure
- [ ] List of all systems with access controls
- [ ] Screenshots of authentication settings (MFA enabled)
- [ ] Sample user access review documentation

#### CC6.2 - New Logical Access
Evidence needed:
- [ ] Onboarding procedure document
- [ ] Sample new hire access tickets
- [ ] Approval workflow screenshots
- [ ] Role-to-permission mapping document

#### CC6.3 - Access Removal
Evidence needed:
- [ ] Offboarding procedure document
- [ ] Sample termination access removal tickets
- [ ] Evidence of timely access revocation
- [ ] Automated deprovisioning logs

### CC7 - System Operations

#### CC7.1 - Vulnerability Management
Evidence needed:
- [ ] Vulnerability management policy
- [ ] Scan reports (monthly)
- [ ] Remediation tracking spreadsheet
- [ ] Penetration test report
- [ ] Evidence of patch management

#### CC7.2 - Incident Management
Evidence needed:
- [ ] Incident response plan
- [ ] Incident tracking system screenshots
- [ ] Sample incident reports
- [ ] Post-mortem documents
- [ ] Incident metrics dashboard

SOC 2 Timeline:

┌─────────────────────────────────────────────────────────────────────────┐
│                        SOC 2 TYPE II TIMELINE                           │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                         │
│  Month 1-2: Gap Assessment & Remediation Planning                       │
│  ├─ Engage auditor for readiness assessment                            │
│  ├─ Identify control gaps                                               │
│  └─ Create remediation roadmap                                          │
│                                                                         │
│  Month 3-4: Control Implementation                                      │
│  ├─ Implement missing controls                                          │
│  ├─ Document policies and procedures                                    │
│  └─ Deploy monitoring and logging                                       │
│                                                                         │
│  Month 5: Type I Audit (optional but recommended)                       │
│  ├─ Point-in-time assessment                                            │
│  ├─ Validates controls are in place                                     │
│  └─ Get early feedback before Type II                                   │
│                                                                         │
│  Month 6-11: Observation Period (Type II requires 6+ months)            │
│  ├─ Controls operating effectively                                      │
│  ├─ Collecting evidence                                                 │
│  └─ Addressing any issues                                               │
│                                                                         │
│  Month 12: Type II Audit                                                │
│  ├─ Auditor reviews evidence                                            │
│  ├─ Tests control effectiveness                                         │
│  └─ Issues final report                                                 │
│                                                                         │
│  Ongoing: Annual re-certification                                       │
└─────────────────────────────────────────────────────────────────────────┘

Agents: security-expert, legal-expert

Implement GDPR requirements for handling EU personal data.

Tasks:

Document lawful basis for processing
Implement data subject rights
Create privacy notices
Prepare Data Processing Agreement
Implement breach notification process

GDPR Compliance Checklist:

## GDPR Compliance Requirements

### Lawful Basis for Processing
- [ ] Documented lawful basis for each processing activity
- [ ] Consent mechanism implemented (where required)
- [ ] Legitimate interest assessments completed
- [ ] Records of processing activities maintained

### Data Subject Rights
- [ ] Right to access (data export)
- [ ] Right to rectification (update data)
- [ ] Right to erasure (delete account)
- [ ] Right to restrict processing
- [ ] Right to data portability (export in machine-readable format)
- [ ] Right to object (opt-out)

### Privacy Documentation
- [ ] Privacy policy (clear, accessible)
- [ ] Cookie policy and consent banner
- [ ] Data Processing Agreement template
- [ ] Internal data protection policy

### Data Protection
- [ ] Privacy by design implemented
- [ ] Data minimization practiced
- [ ] Encryption at rest and in transit
- [ ] Access controls limiting data access
- [ ] Retention periods defined and enforced

### Breach Management
- [ ] Breach detection mechanisms
- [ ] Breach notification procedure (72 hours)
- [ ] Breach register maintained
- [ ] DPO designated (if required)

Data Subject Rights Implementation:

// app/api/privacy/export/route.ts
// Right to access / data portability

import { NextResponse } from 'next/server';
import { auth } from '@/lib/auth';
import { prisma } from '@/lib/prisma';

export async function POST(request: Request) {
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  // Gather all user data
  const userData = await prisma.user.findUnique({
    where: { id: session.user.id },
    include: {
      profile: true,
      projects: true,
      activityLogs: true,
      preferences: true,
    }
  });

  // Format for portability (JSON)
  const exportData = {
    exportDate: new Date().toISOString(),
    user: {
      email: userData.email,
      name: userData.name,
      createdAt: userData.createdAt,
    },
    profile: userData.profile,
    projects: userData.projects.map(p => ({
      name: p.name,
      createdAt: p.createdAt,
      // ... other fields
    })),
    activityHistory: userData.activityLogs,
    preferences: userData.preferences,
  };

  // Log the export request
  await logSecurityEvent({
    eventType: 'data.export',
    actor: {
      userId: session.user.id,
      email: session.user.email,
      // ...
    },
    action: 'GDPR data export requested',
    outcome: 'success'
  });

  return NextResponse.json(exportData);
}

// app/api/privacy/delete/route.ts
// Right to erasure

export async function POST(request: Request) {
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  const { confirmation } = await request.json();

  if (confirmation !== 'DELETE MY ACCOUNT') {
    return NextResponse.json(
      { error: 'Confirmation required' },
      { status: 400 }
    );
  }

  // Soft delete with retention period for legal requirements
  await prisma.user.update({
    where: { id: session.user.id },
    data: {
      deletedAt: new Date(),
      deleteScheduledAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000), // 30 days
      email: `deleted_${session.user.id}@deleted.local`,
      name: '[Deleted User]',
    }
  });

  // Anonymize related data
  await prisma.activityLog.updateMany({
    where: { userId: session.user.id },
    data: { userId: null, anonymized: true }
  });

  // Log deletion request
  await logSecurityEvent({
    eventType: 'data.deletion',
    actor: {
      userId: session.user.id,
      email: session.user.email,
    },
    action: 'GDPR deletion requested',
    outcome: 'success'
  });

  // Terminate all sessions
  await prisma.session.deleteMany({
    where: { userId: session.user.id }
  });

  return NextResponse.json({
    message: 'Account scheduled for deletion',
    deletionDate: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000)
  });
}

Security Questionnaire Responses#

Common Questions and Answers:

## Security Questionnaire Template Responses

### Data Security

**Q: How is customer data protected?**
A: Customer data is protected through multiple layers of security:
- Encryption at rest using AES-256
- Encryption in transit using TLS 1.3
- Access controls limiting data access to authorized personnel
- Regular security assessments and penetration testing
- SOC 2 Type II certified infrastructure

**Q: Where is data stored?**
A: Data is stored in [Cloud Provider] data centers in [Region].
For enterprise customers, we offer data residency options in
US, EU, and APAC regions.

**Q: How long is data retained?**
A: Active account data is retained for the duration of the
subscription. Upon account deletion, data is purged within
30 days except where legal retention requirements apply.

### Access Control

**Q: What authentication methods are supported?**
A: We support:
- Email/password with complexity requirements
- Multi-factor authentication (TOTP, SMS, WebAuthn)
- Single Sign-On via SAML 2.0 and OIDC
- Social login (Google, Microsoft)

**Q: How are user sessions managed?**
A: Sessions are:
- Secured with HttpOnly, Secure cookies
- Expire after 24 hours of inactivity
- Can be remotely terminated by admins
- Logged with IP and device information

### Incident Response

**Q: What is your breach notification policy?**
A: We notify affected customers within 72 hours of confirmed
breach detection, in compliance with GDPR requirements.
Notification includes nature of breach, data affected,
and remediation steps.

**Q: Do you have an incident response plan?**
A: Yes, our incident response plan includes:
- 24/7 monitoring and alerting
- Defined escalation procedures
- Communication templates
- Post-incident review process
- Annual tabletop exercises

Starting the Workflow#

# Start security compliance workflow
bootspring workflow start enterprise-security

# Run gap assessment
bootspring enterprise security assess

# Generate security documentation
bootspring enterprise security docs

# Prepare for SOC 2 audit
bootspring enterprise soc2 prepare

Deliverables#

A successful Enterprise Security workflow produces:

Gap assessment report
Remediation roadmap
Security policies and procedures
SOC 2 Type II report
GDPR compliance documentation
Data Processing Agreement template
Security questionnaire responses
Incident response plan

Best Practices#

Start early - Compliance takes months, not weeks
Automate evidence collection - Manual collection doesn't scale
Build security into the product - Retrofitting is expensive
Document as you go - Auditors love documentation
Train your team - Security is everyone's responsibility
Plan for ongoing compliance - It's not a one-time project

Compliance Cost Estimates#

Item	Cost Range	Notes
SOC 2 auditor	$20K-$50K	Annual, varies by complexity
Compliance platform	$10K-$30K/year	Vanta, Drata, Secureframe
Penetration test	$5K-$20K	Annual, scope-dependent
Security tools	$5K-$20K/year	SIEM, vulnerability scanning
Internal effort	2-3 months FTE	Initial implementation