🛡️SOC 2 CC5.2Rule: SOC2-CC5-002high

Technology General Controls (ITGC)

Description

The entity selects and develops general control activities over technology — including access controls, change management, system operations, and segregation of duties — to support the achievement of security objectives.

⚠️ Risk Impact

ITGC failures cascade into application-level failures that are difficult to detect at the application layer. When the underlying platform's change management is undisciplined, application-level controls inherit the chaos.

🔍 How EchelonGraph Detects This

SOC2-CC5-002Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.

🔧 Remediation

Document the ITGC stack: cloud account management, CI/CD policy, IaC review gates, secret management, IAM hygiene. Apply policy-as-code (Kyverno, OPA, AWS Config) to enforce. Quarterly ITGC review tests evidence of operation.

💀 Real-World Attack Scenario

A company's application-level access controls were rigorous but the underlying CI/CD allowed any engineer to deploy any service via shared service-account credentials. When an engineer's laptop was compromised, the attacker used the CI/CD credentials to deploy a malicious sidecar to a production payment service. The application-level controls couldn't detect the malicious sidecar because the deployment 'came through legitimate CI/CD'. ITGC weakness ($1.4M direct loss + qualified SOC 2 opinion).

💰 Cost of Non-Compliance

ITGC weaknesses as breach contributor: 53% of cloud breaches in 2024 (Mandiant M-Trends). Average breach cost when ITGC is weak: 2.7× higher than when ITGC is strong.

📋 Audit Questions

  • 1.Show me the ITGC matrix.
  • 2.How are CI/CD service accounts scoped and rotated?
  • 3.What is the IaC review process for production changes?
  • 4.Show me a case where the ITGC blocked a non-compliant change.

🎯 MITRE ATT&CK Mapping

T1078.004 — Cloud AccountsT1098 — Account Manipulation

⚡ Common Pitfalls

  • Application security strong but CI/CD wide open — attackers bypass the application layer entirely
  • IaC policy-as-code documented but not enforced (audit/log mode only)
  • Service accounts in CI/CD shared across teams or environments

📈 Business Value

Robust ITGC is the unglamorous foundation that makes application security real. Companies with strong ITGC have measurably lower breach rates and shorter MTTR — and qualify for cyber-insurance terms that exclude under-controlled organizations.

⏱️ Effort Estimate

Manual

60-120 hours for comprehensive ITGC documentation + policy-as-code rollout

With EchelonGraph

EchelonGraph evaluates ITGC continuously; flags drift from approved baseline

🔗 Cross-Framework References

ISO27001-A.5.31NIST-AC-3

Automate SOC 2 CC5.2 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →