Approvals, signatures and what waits on Kyle
Lucent Axis, SCOPE. 28 Oct 2026. Owner: Kyle. Nearly every SOC 2 item outside the code is now waiting on one of four things: a document approved, a signature, a click only an owner can make, or a decision. This page is all of them in one place, so they can be done in one sitting. Tick each line on the readiness page once done; this page is the record of who approved what and when.
1. Approve the documents (Kyle)
Read, change what we will not actually do, then write your name and the date. The auditor tests what a policy says, so a promise we will not keep should be removed, not approved. Where Kyle owns a document, Dan reads it as the second reader so nobody approves only their own work.
| Document | Owner | Covers | Approved by | Date | Second reader | Date |
|---|---|---|---|---|---|---|
| Information security policy | Dan | ORG-09, TS-1, TS-7 | n/a | |||
| Change management policy | Dan | ORG-07, SC-5, SC-6, TS-9, TS-11 | n/a | |||
| Data classification, retention and disposal | Dan | DB-5, DB-6, TS-6 | n/a | |||
| BYOD and laptop policy | Kyle | ORG-15, ORG-16 | ||||
| Incident response plan | Kyle | LM-3, ORG-25 | ||||
| Business continuity and disaster recovery | Kyle, Dan | AV-1 to AV-3, ORG-23, ORG-24 | ||||
| Joining, leaving and access reviews | Kyle | ORG-13, ORG-19, ORG-20 | ||||
| Risk register | Kyle, Dan | ORG-17, TS-5, TS-11 (accept R16) | ||||
| Connecting a source system | Dan | VE-2, TS-12, VN-3, LM-2 per integration | n/a | |||
| Security awareness training | Kyle | ORG-14 | ||||
| Subprocessors and vendor reports | Kyle | VN-1 to VN-3, ORG-18 | ||||
| System description | Kyle, Dan | ORG-10, TS-8 | ||||
| October monthly review | Dan | TS-4, ORG-07 | n/a |
2. Everyone signs (ORG-14)
Once section 1 is done. Everyone with access to SCOPE's systems reads the information security policy, the BYOD policy and the security training, then signs here. Again on every joining, and every year in October.
| Name | Role | Policies read (version date) | Date signed | Signature |
|---|---|---|---|---|
| Kyle | Compliance owner | |||
| Dan | App developer, data / platform engineer |
3. Clicks only an owner can make (Kyle)
Each is a few minutes in a dashboard. Steps are in this-week.md.
| Item | Where | What |
|---|---|---|
| OW-6 | GitHub org lucent-axis, Vercel team lucent-axis, Lucent Axis Supabase organization |
Make Dan a second Owner on each, so no account rests on one person |
| OW-6, DB-7 | The company vault | Accept Dan's invite to the vault (Bitwarden free organization, see Free first), then put each account's recovery codes in it |
| ORG-06 | GitHub org settings | Require two-factor authentication for every member |
| ORG-06 | Google Workspace admin | Enforce 2-step verification for everyone |
| ID-1 | Supabase organization | Require MFA |
| DB-7 | Supabase project | Enforce SSL; network restrictions |
| ID-7 | Supabase project, Email sign-in | Passwords of 12 or more with letters and digits; leaked-password protection on |
| OW-2 | Vercel team billing | A company card before the Pro trial ends |
Dan's Supabase role can read these settings and change none of them (tried 28 Oct). Making Dan an Owner first (the OW-6 line) lets Dan do the rest.
4. Decisions
| Item | Decision | Who | What we know |
|---|---|---|---|
| ORG-04 | Compliance platform and auditor, or a Type I run ourselves with a CPA firm hired directly | Kyle and Dan | Quote request ready in vendors-and-counsel.md; not sent. A platform is needed before the Type II window (ORG-30) |
| ORG-36 | Who counsel is | Kyle or Business lead | Brief ready in vendors-and-counsel.md |
| AV-2 | Pay for point-in-time recovery, or write down that up to a day of data could be lost | Kyle and Dan | Today: a daily backup, so up to 24 hours (bc-dr-plan.md) |
| VN-1 | How to get Supabase's SOC 2 report, which Pro does not include | Kyle | Options in subprocessors.md |
| ORG-35 | COFI in the audit boundary at Type II, or not | Dan and Kyle | Default: out, until a COFI client asks (vendors-and-counsel.md) |
5. Questions to send
Each is written and ready in vendors-and-counsel.md. Nothing has been sent.
| Item | To | Who sends |
|---|---|---|
| ORG-04 | Three compliance platforms | Kyle or Dan |
| ORG-12 | The auditor, once chosen | Kyle |
| ORG-31 | The insurance broker | Business lead |
| ORG-34 | Novvia | Kyle |
| ORG-36, ORG-08, VN-5 | Counsel, once named | Kyle or Business lead |
6. Meetings to hold
| Item | What | Who | Script |
|---|---|---|---|
| TS-2 | The first quarterly security review | Kyle and Dan | control-calendar.md |
| ORG-20 | The first access review: fill and sign the table | Kyle and Dan | evidence/2026/2026-10-28-access-review.md |
| ORG-25 | Incident response tabletop, one hour | Kyle and Dan | tabletop-exercises.md |
| ORG-24 | Disaster recovery tabletop, one hour | Kyle and Dan | tabletop-exercises.md |
| ORG-23 | The first timed restore into a new project | Dan | bc-dr-plan.md |