BuiltForProd by Nexstella
Infrastructure ready for the audit, with evidence on record
Getting infrastructure ready for a SOC 2 audit means controls aligned with the framework, each one enforced in code and leaving evidence behind. BuiltForProd, Nexstella's production engineering brand, builds that into your own accounts. The result of the audit stays with your auditor.
01 How we work
What makes readiness hold up under review
-
Controls that run, not policies that wait
Access rules, logging and encryption are enforced by the platform itself, so a reviewer sees controls that operate every day rather than a document that describes good intentions.
-
Evidence collected as you work
Configuration checks run continuously and keep their results. When the auditor asks for proof, your team opens a record instead of taking screenshots the week before fieldwork.
-
A mapping your auditor can follow
In the AWS Enterprise Baseline, 29 conformance pack templates cover 11 mapped frameworks, and 17 verification checks are aligned with SOC 2, each pointing at the control it supports.
-
Readiness you can keep up
The controls live in repositories your team owns, so the next audit period starts from a working setup and not from a fresh scramble.
What we'll tell you
No product can hand you a certificate, and readiness aligned with SOC 2 is not one. It prepares the infrastructure; policies, people and the audit result stay with you and the auditor.
The BuiltForProd Standard
The eight questions behind audit-ready infrastructure
The BuiltForProd Standard defines production in eight properties, always in this order. Step through them to see the question each one asks and what changes when the answer becomes yes.
-
Secure
Can you list everyone who can change production today?
What changes
People sign in through one identity provider with short sessions and role-based permission sets, so the list is generated, not remembered.
-
Reliable
What happens to customers when one zone or service fails?
What changes
Workloads are spread across zones and failure is part of the design, so an outage in one place degrades the service instead of stopping it.
-
Observable
Could you show an auditor the trail of a production change?
What changes
Organization-wide audit logs, configuration history and alerts are on from the first deploy, and the trail cannot be switched off from inside an account.
-
Scalable
Does adding an account or a region mean starting over?
What changes
Accounts and address space are laid out with room to grow, so expansion is a reviewed edit to code that keeps every existing control in place.
-
Automated
Are infrastructure changes reviewed before they reach production?
What changes
Every change goes through a pull request and a pipeline with a plan to read, and production applies wait for the reviewers you name.
-
Recoverable
When did your team last walk through a full restore?
What changes
Backups are defined in code and restore steps are written and rehearsed, so recovery is a procedure your team has already walked through.
-
Compliant
Can you show each control working, with evidence an auditor can open?
What changes
Controls are aligned with the frameworks you choose, and checks keep evidence on record. This is readiness for review, never a certificate.
-
Operable
Could your team keep the controls running without outside help?
What changes
Runbooks, owners and an audit guide are handed over, so the controls survive staff changes and the next audit period.
How it starts
-
A 30-minute call about the deadline
Bring the audit date, the cloud you run on and any questions the auditor or a customer has sent. An engineer who scopes this work tells you what is realistic before that date.
-
A fixed-fee scope
The scope names the controls in play, the decisions needed from your team and a fixed fee quoted before work starts.
-
Build, verify and hand over
Engineers deploy the foundation into your accounts, run the verification checks and hand over the repositories with the guide your auditor will want to read.
Ready to talk it through?
Book a call with BuiltForProd02 A typical situation
What this usually looks like
Take a business software company that has promised its largest prospect an audit report by a set date. Its cloud grew without a plan, several engineers share administrator access, and logs are kept wherever each service happened to put them.
We would replace shared access with sign-on and roles, centralize logging where nobody can delete it and turn the key settings into code with checks attached. Gaps that only policy can close would go to a list with an owner, so the team knows what is left for the auditor to see.
03 Questions
Questions people ask
No, and no product can. The work makes your infrastructure ready, with controls aligned with SOC 2 and evidence on record. Policies, training and the audit itself sit with your team and your auditor, who decides the result.
The AWS Enterprise Baseline maps controls aligned with 11 frameworks, including SOC 2, NIST CSF, PCI DSS v4.0.1 and HIPAA Security, all as readiness and never as certification.
Not for the infrastructure controls. The checks keep their own records in your accounts. An audit platform for policies and people can sit alongside them.
Tell the engineer on the call. The scope starts from what you run today, and nothing existing is imported automatically; moving it across is scoped work with its own steps.
04 Book a call
Get ready before the auditor arrives
Book a call with BuiltForProd. Bring the audit date and the questions you have received, and hear what can be ready by then and what cannot.
BuiltForProd by Nexstella: Nexstella's production engineering brand
Want the full picture? Read Data governance, cybersecurity and responsible AI.
Also written for you: Infrastructure due diligence , Secrets management .
Last updated