Appearance
LPRIV Evidence Mapping — SOC2 CC6.3 and HIPAA 164.312(a)(1)
Purpose: Maps the least privilege audit evidence to SOC2 Type II and HIPAA requirements. Scope: LPRIV-001 through LPRIV-018 (April 2026 audit cycle)
SOC2 Criteria Mapping
CC6.3 — The entity implements logical access security measures to protect against threats from sources outside its system boundaries
| LPRIV Story | Evidence Document | Control Satisfied |
|---|---|---|
| LPRIV-001 | compliance/lpriv-secops-audit.md §LPRIV-001 | App registrations have documented, minimal Graph permissions |
| LPRIV-002 | compliance/lpriv-secops-audit.md §LPRIV-002 | Managed identity RBAC scoped to specific resources |
| LPRIV-003 | compliance/lpriv-secops-audit.md §LPRIV-003 | Database access restricted to application-level role (not admin) |
| LPRIV-004 | compliance/lpriv-secops-audit.md §LPRIV-004 | Key Vault access is read-only (getSecret, readMetadata only) |
| LPRIV-005 | compliance/lpriv-secops-audit.md §LPRIV-005 | Table Storage: data plane only, dedicated account, not admin |
| LPRIV-006 | security/lpriv-secops.md | SecOps platform least privilege report — all identities documented |
| LPRIV-008 | compliance/lpriv-cicd-audit.md §LPRIV-008 | CI/CD Azure RBAC: Contributor+UAA is minimum for Terraform; documented tradeoff |
| LPRIV-009 | compliance/lpriv-cicd-audit.md §LPRIV-009 | CI/CD AWS IAM: AdministratorAccess flagged; logging account scoped (target pattern) |
| LPRIV-010–012 | compliance/lpriv-ops-automation-audit.md §LPRIV-010-012 | Ops-automation app registration: 25 permissions; Mail.ReadWrite removed |
| LPRIV-015 | compliance/lpriv-ops-automation-audit.md §LPRIV-015 | GitHub bot token: member role only, branch protection prevents self-merge |
| LPRIV-018 | compliance/lpriv-ops-automation-audit.md §Remediated | Mail.ReadWrite and Mail.Send removed from kobe-security-audit |
CC6.1 — Logical and physical access to data is restricted to authorized and necessary individuals
| LPRIV Story | Evidence Document | Control Satisfied |
|---|---|---|
| LPRIV-001 | compliance/lpriv-secops-audit.md §LPRIV-001 | SecOps app registration Graph permissions: User.Read, GroupMember.Read.All, User.Read.All (no write) |
| LPRIV-002 | compliance/lpriv-secops-audit.md §LPRIV-002 | Managed identity: no Contributor or Owner, resource-scoped RBAC only |
| LPRIV-003 | compliance/lpriv-secops-audit.md §LPRIV-003 | PostgreSQL: secops_app role has DML-only access; secopsadmin connection replaced |
| LPRIV-007 | compliance/lpriv-cicd-audit.md + azure-infra PR #649 | KV Admin at sub scope being replaced with KV Crypto Officer + Secrets Officer at specific KVs |
CC6.2 — Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users
| Story | Evidence | Control |
|---|---|---|
| LPRIV-015 | compliance/lpriv-ops-automation-audit.md §LPRIV-015 | cirius-kobe-bot is a registered org member with documented access level |
| All LPRIV | security/lpriv-baseline.md | Baseline document establishes approved identities and their expected access levels |
HIPAA Mapping
§164.312(a)(1) — Access Control
Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights.
| LPRIV Story | Evidence | Compliance Action |
|---|---|---|
| LPRIV-001 | compliance/lpriv-secops-audit.md §LPRIV-001 | SecOps app registration: only 3 Graph permissions (User.Read, GroupMember.Read.All, User.Read.All), all required, zero orphaned |
| LPRIV-002 | compliance/lpriv-secops-audit.md §LPRIV-002 | Managed identity for SecOps Container App: AcrPull + Key Vault Secrets User only, no subscription-level roles |
| LPRIV-003 | compliance/lpriv-secops-audit.md §LPRIV-003 + KV secops-db-url updated 2026-04-15 | Application connects as secops_app (DML-only) not secopsadmin (superuser). Evidence: KV secret updated timestamp |
| LPRIV-004 | compliance/lpriv-secops-audit.md §LPRIV-004 | Key Vault Secrets User: getSecret + readMetadata only. No key/cert/write access |
| LPRIV-007 | azure-infra PR #649 (pending merge) | KV Administrator → Crypto Officer + Secrets Officer, scoped to specific Key Vaults |
| LPRIV-010–012 | compliance/lpriv-ops-automation-audit.md §LPRIV-010-012 | kobe-security-audit: 25 read-only permissions; Mail.ReadWrite removed |
| LPRIV-018 | compliance/lpriv-ops-automation-audit.md §Remediated | Mail.ReadWrite removed from audit app registration — prevents unauthorized mailbox access |
§164.312(a)(2)(i) — Unique User Identification
| Story | Evidence | Compliance Action |
|---|---|---|
| LPRIV-001–018 | All LPRIV audit documents | Each service identity has a unique, documented App ID or principal ID. No shared credentials between services |
| LPRIV-003 | secops.tf ignore_changes = [value] + KV secops-db-url | secops_app is a dedicated role — not shared with any other application |
§164.312(b) — Audit Controls
| Story | Evidence | Compliance Action |
|---|---|---|
| LPRIV-019 | ops-automation PR #277 | Automated weekly check: pim-audit.yml LPRIV baseline job fires HIGH finding to SecOps on any permission deviation |
| All LPRIV | compliance/annual-review-checklist.md | Quarterly manual LPRIV review documented and scheduled |
Audit Evidence Artifacts
| Artifact | Location | Description |
|---|---|---|
| SecOps app registration Graph permissions | compliance/lpriv-secops-audit.md | LPRIV-001: 3 permissions, all documented |
| Managed identity RBAC assignments | compliance/lpriv-secops-audit.md | LPRIV-002: 2 roles, resource-scoped |
| PostgreSQL role grants | compliance/lpriv-secops-audit.md | LPRIV-003: secops_app DML-only; KV updated 2026-04-15T15:31:18Z |
| Key Vault access scope | compliance/lpriv-secops-audit.md | LPRIV-004: Key Vault Secrets User data actions only |
| Table Storage access | compliance/lpriv-secops-audit.md | LPRIV-005: Storage Table Data Contributor on dedicated account |
| SecOps least privilege report | security/lpriv-secops.md | LPRIV-006: Full platform report with SOC2/HIPAA mapping |
| KV Administrator scope narrowing | compliance/lpriv-cicd-audit.md + azure-infra PR #649 | LPRIV-007: Post-PR: per-KV Officer roles replace sub-level KV Admin |
| CI/CD Azure RBAC audit | compliance/lpriv-cicd-audit.md | LPRIV-008: 19 assignments documented; Contributor+UAA tradeoff justified |
| CI/CD AWS IAM audit | compliance/lpriv-cicd-audit.md | LPRIV-009: AdministratorAccess flagged; logging account scoped pattern documented |
| kobe-security-audit permissions | compliance/lpriv-ops-automation-audit.md | LPRIV-010-012: 25 permissions (post-remediation); Mail.ReadWrite removed |
| Mail.ReadWrite removal proof | Graph API DELETE 2026-04-15; ops-automation PR #277 | LPRIV-018: Removed from SP a373da7a, count verified 27→25 |
| Automated LPRIV check | ops-automation PR #277 (pim-audit.yml) | LPRIV-019: Weekly automated baseline check in CI |
| Least privilege baseline | security/lpriv-baseline.md | LPRIV-020: Expected state for all identities |
| Quarterly review checklist | compliance/annual-review-checklist.md | LPRIV-021: Quarterly LPRIV review scheduled |
Gaps and Open Items
| Gap | Risk | Story | Status |
|---|---|---|---|
| KV Administrator at sub scope (post-LPRIV-007 pending merge) | MEDIUM — functional Owner in 3 subs until PR #649 merged and old roles removed | LPRIV-007 | IN_PROGRESS |
| Cortex XDR API key role unverified | LOW — operations are read-only but role not confirmed | LPRIV-013 | Pending Rory console access |
| AWS github-deploy-main AdministratorAccess | HIGH — known tradeoff, adoption of logging account pattern is long-term goal | LPRIV-009 | BACKLOG |
| id-agents-prod Reader/Security Reader at logging sub scope | LOW — read-only, investigation pending whether RG scope is feasible | LPRIV-007 | Deferred |
Document History
| Date | Change | Author |
|---|---|---|
| April 2026 | Initial mapping — LPRIV-001 through LPRIV-018 | Kobe |