Continuous SOC Compliance

Transitioning from point-in-time audits to continuous readiness through Compliance-as-Code (CaC) and team literacy.

Compliance-as-Code Simulator

Test Terraform/Kubernetes configurations against a simulated NIS2 Policy Engine (OPA/Sentinel).

main.tf (Infrastructure)

resource "aws_security_group" "telco_mgmt" {
  name = "management_plane"
  
  ingress {
    from_port = 23
    to_port   = 23
    protocol  = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  # NIS2 Article 21.2.e (Encryption)
  tls_enabled = false
}

OPA // POLICY_SCANNER

BLOCKED

> Sending infra spec to policy agent...

> Evaluating against 'nis2-art21' policies...

✕ [DENY: true] VIOLATION (nis2.crypto.in_transit). Unencrypted management plane detected.

HINT: Article 21.2 requires encryption in transit. Ensure TLS is enabled and legacy unencrypted ports (e.g., Telnet/23) are blocked.

TEAM // LITERACY_SCORECARD

SOC Training Tracker

Tracking mandatory Article 20.2 cybersecurity hygiene training across the engineering fleet.

Core Network Architecture100%

L1 Incident Response85%

RAN Field Engineers40%

DOCS // CONTINUOUS_AUDIT

Operational Handbook

📅

Daily: Log Hashing

Ensure SOC SIEM logs are immutably hashed and shipped to cold storage to prevent tampering.

🚨

Weekly: 24H Drills

Simulate a minor incident to test the Early Warning notification pipeline to the CSIRT.

🛡️

Monthly: CaC Review

Review Open Policy Agent (OPA) rulesets to ensure they match any new NIS2 technical guidance.