SOC 2 for engineering teams: CC6, CC7 and CC8 controls and the evidence auditors test

"""Export the change population for a SOC 2 period and flag changes that skipped review.

Lists every pull request merged into the default branch between two dates, with who wrote it,
who approved its final commit and whether its required checks passed, as CSV for the auditor.
Usage: GITHUB_TOKEN=... python3 change_population.py OWNER/REPO 2026-01-01 2026-06-30 main ci/test
"""

import csv
import json
import os
import sys
import urllib.request

API = "https://api.github.com"


def get(path):
    request = urllib.request.Request(API + path, headers={"Accept": "application/vnd.github+json"})
    if os.environ.get("GITHUB_TOKEN"):
        request.add_header("Authorization", "Bearer " + os.environ["GITHUB_TOKEN"])
    with urllib.request.urlopen(request) as response:
        return json.load(response)


def merged_pulls(repo, base, start, end):
    page = 1
    while True:
        query = f"state=closed&base={base}&sort=updated&direction=desc&per_page=100&page={page}"
        pulls = get(f"/repos/{repo}/pulls?{query}")
        for pull in pulls:
            if pull["updated_at"][:10] < start:
                return  # sorted by last update; merging updates a pull request
            if pull["merged_at"] and start <= pull["merged_at"][:10] <= end:
                yield pull
        if len(pulls) < 100:
            return
        page += 1


def main(repo, start, end, base, *required_checks):
    out = csv.writer(sys.stdout)
    out.writerow(["pr", "merged_at", "author", "approvers_of_final_commit", "checks", "exception"])
    for pull in merged_pulls(repo, base, start, end):
        head = pull["head"]["sha"]
        reviews = get(f"/repos/{repo}/pulls/{pull['number']}/reviews?per_page=100")
        approved = {r["user"]["login"] for r in reviews
                    if r["state"] == "APPROVED" and r["commit_id"] == head}
        approvers = sorted(approved - {pull["user"]["login"]})
        runs = get(f"/repos/{repo}/commits/{head}/check-runs?per_page=100")["check_runs"]
        statuses = get(f"/repos/{repo}/commits/{head}/status")["statuses"]
        passed = {run["name"] for run in runs if run["conclusion"] == "success"}
        passed |= {status["context"] for status in statuses if status["state"] == "success"}
        missing = [name for name in required_checks if name not in passed]
        exception = "; ".join(
            (["no independent approval of the final commit"] if not approvers else [])
            + [f"check {name} did not pass" for name in missing]
        )
        out.writerow([pull["number"], pull["merged_at"], pull["user"]["login"],
                      " ".join(approvers), " ".join(sorted(passed)), exception])


if __name__ == "__main__":
    main(*sys.argv[1:])

{
  "system": "Payments platform (as named in the system description)",
  "period": ["2026-01-01", "2026-06-30"],
  "controls": [
    {
      "id": "CHG-1",
      "criteria": ["CC8.1"],
      "control": "Changes to the default branch need an approving review of the final commit by someone other than the author, and passing required checks",
      "evidence": "change_population.py export for the period, ruleset settings with their change history",
      "frequency": "every change",
      "owner": "engineering productivity lead"
    },
    {
      "id": "CHG-2",
      "criteria": ["CC8.1", "CC6.3"],
      "control": "Only the deployment pipeline can deploy to production; deployments require an approved release",
      "evidence": "Cloud IAM policy export, deployment log for the period",
      "frequency": "every deployment",
      "owner": "platform lead"
    },
    {
      "id": "ACC-1",
      "criteria": ["CC6.2", "CC6.3"],
      "control": "Production access is granted by role through the identity provider and removed within one business day of leaving",
      "evidence": "Joiner and leaver tickets reconciled with identity provider logs; quarterly access review sign-off",
      "frequency": "quarterly review, every leaver",
      "owner": "security engineering"
    },
    {
      "id": "VUL-1",
      "criteria": ["CC7.1"],
      "control": "Dependency and image scanning on every build; configuration drift detection daily",
      "evidence": "Scanner results with triage decisions, drift alerts and their tickets",
      "frequency": "every build, daily",
      "owner": "product security"
    },
    {
      "id": "MON-1",
      "criteria": ["CC7.2", "CC7.3"],
      "control": "Security alerts are triaged by the on-call engineer and classified as event or incident",
      "evidence": "Alert queue export with acknowledgement times and classifications",
      "frequency": "continuous",
      "owner": "SRE on-call"
    },
    {
      "id": "IR-1",
      "criteria": ["CC7.4", "CC7.5"],
      "control": "Declared incidents follow the incident response plan, with a post-incident review and recovery test",
      "evidence": "Incident records, post-incident reviews, restore test results",
      "frequency": "every incident, restore test quarterly",
      "owner": "incident commander rota"
    }
  ]
}