RepoScope Compliance intelligence for your codebase

Gap & Remediation Plan — SOC 2 Type II

Company: Acme Corp
Generated: June 27, 2026
Audit Period: 2026-01-01 to 2026-12-31

Summary

Total gaps identified: 2
Critical/High severity: 0
Medium/Low severity: 2
Controls not assessed (outside scope): 7

Open Items

Gap 1: CC5.1 — Technology General Controls

Framework: SOC 2 Type II
Severity: Medium
Status: ❌ OPEN
Findings: 2
- src/lib/hash.ts:9 — MD5 used to hash API tokens (medium)
- src/lib/hash.ts:17 — SHA-1 used for a cache-key fingerprint (low)
Recommended Fix: Use SHA-256 for integrity; use bcrypt/scrypt/argon2 for passwords. Migrate to SHA-256.
Owner: [ORG TO COMPLETE: Remediation owner]
Target Date: [ORG TO COMPLETE: Target remediation date]
Completion Evidence: [ORG TO COMPLETE: Describe how closure will be verified]

Gap 2: CC6.6 — System Boundaries

Framework: SOC 2 Type II
Severity: Medium
Status: ❌ OPEN
Findings: 2
- src/index.ts:38 — CORS configured with a wildcard origin ('*') on the Express app (medium)
- src/middleware/headers.ts:12 — Access-Control-Allow-Origin response header set to '*' (medium)
Recommended Fix: Restrict CORS to an explicit allow-list of trusted origins.
Owner: [ORG TO COMPLETE: Remediation owner]
Target Date: [ORG TO COMPLETE: Target remediation date]
Completion Evidence: [ORG TO COMPLETE: Describe how closure will be verified]

Controls Outside Scope

Control ID	Control Name	Required Evidence
`CC1.1`	COSO Principle 1 — Integrity & Ethics	Policy docs, governance records, training evidence
`CC2.1`	Information for Internal Use	Policy docs, governance records, training evidence
`CC3.1`	Risk Assessment	Policy docs, governance records, training evidence
`CC4.1`	Design & Operate Monitoring Controls	Policy docs, governance records, training evidence
`CC6.3`	Access Removal	Organizational policy / process documentation
`CC7.1`	Monitoring of Controls	Organizational policy / process documentation
`CC8.1`	Change Management	Organizational policy / process documentation

Tracking

Gap #	Control	Severity	Owner	Target Date	Status
1	`CC5.1`	Medium	[ORG TO COMPLETE: Owner]	[ORG TO COMPLETE: Target date]	Open
2	`CC6.6`	Medium	[ORG TO COMPLETE: Owner]	[ORG TO COMPLETE: Target date]	Open

Previously Remediated (Game Plan archive)

Removed hardcoded Stripe secret key from the billing service — completed 2026-04-18
Enabled TLS certificate verification on outbound webhook calls — completed 2026-05-09

Disclaimer: Code-level controls only. Coverage percentages reflect how many framework controls have matching RepoScope detectors. This is a development aid, not a certification tool — auditors make the final determination.